支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 19c365de8227a648e44b50e17d46a9ad0be3ea5e

来源
https://github.com/nettitude/CVE-2024-20356
关联漏洞
标题:Cisco Integrated Management Controller 操作系统命令注入漏洞 (CVE-2024-20356)
Description:Cisco Integrated Management Controller（IMC）是美国思科（Cisco）公司的一套用于对UCS（统一计算系统）进行管理的软件。该软件支持HTTP、SSH访问等，并可对服务器进行开机、关机和重启等操作。 Cisco Integrated Management Controller存在操作系统命令注入漏洞，该漏洞源于对用户输入验证不足。远程攻击者利用该漏洞对受影响的系统执行命令注入攻击，并将其权限提升为 root。
Description
This is a proof of concept for CVE-2024-20356, a Command Injection vulnerability in Cisco's CIMC.
介绍
# CVE-2024-20356
This is a proof of concept for CVE-2024-20356, a Command Injection vulnerability in Cisco's CIMC.

Full technical details can be found at [https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom](https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom)

## Usage
```
Usage: CVE-2024-20356.py [-h] -t HOST -u USERNAME -p PASSWORD [-a ACTION] [-c CMD] [-v]
options:
  -h, --help            Show this help message and exit
  -t HOST, --host HOST  Target hostname or IP address (format 10.0.0.1 or 10.0.0.2:1337)
  -u USERNAME, --username USERNAME
                        Username (default: admin)
  -p PASSWORD, --password PASSWORD
                        Password (default: cisco)
  -a ACTION, --action ACTION
                        Action: test, cmd, shell, dance (default: test)
  -c CMD, --cmd CMD     OS command to run (Default: NONE)
  -v, --verbose         Displays more information about cimc
```

Example commands:
```
CVE-2024-20356.py --host 192.168.x.x -u admin -p your_password -v
CVE-2024-20356.py --host 192.168.x.x -u admin -p your_password -c 'id'
CVE-2024-20356.py --host 192.168.x.x -u admin -p your_password -a shell
CVE-2024-20356.py --host 192.168.x.x -u admin -p your_password -a dance
```

Use the `--help` argument for full usage instructions.

## Disclaimer
This proof-of-concept is for demonstration purposes and should not be used for illegal activities. LRQA Nettitude are not responsible for any damage caused by the use or misuse of this code.
文件快照

 [4.0K]  /data/pocs/19c365de8227a648e44b50e17d46a9ad0be3ea5e
├── [ 11K]  CVE-2024-20356.py
├── [ 34K]  LICENSE
└── [1.5K]  README.md

0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。