ns-sp4ce / cve-2021-21972 Goto Github PK

RT:

C:\Users\test\Desktop\CVE-2021-21972-main>python CVE-2021-21972.py -url 10.10.10.10

            Test On vCenter 6.5 Linux/Windows
                    By: Sp4ce
                    Github:https://github.com/NS-Sp4ce

[] Check https://10.10.10.10 is vul ...
[!] https://10.10.10.10 IS vul ...
[] Trying linux payload...
[+] Shell upload success, now check is shell exist...
[-] Shell upload success, BUT NOT EXIST, trying windows payload...

C:\Users\test\Desktop\CVE-2021-21972-main>

手动上传tar包测试，linux的返回“SUCCESS”，windows返回“FAILED”
但是访问shell地址还是404

Can you explant it?

Hello,
Thanks for the PoC, I aws looking at Linux.tar file that contains the directory where the webshell should be written.
By testing on 6.7 unpatched servers, it's not getting JSP compilation/execution that easily (and strace/find does not give up that easily a proper webapps path).

Cheers

额外，利用CVE-2021-21792 漏洞回传 vCener 服务器进行复写操作的地址是什么呢？

[+] Identified: VMware vCenter Server 7.0.1 build-17005016 good
[-] vCenter 6.7U2+ running website in memory, so this exp can't work for 6.7 u2+.

after I connect to the webshell with Behinder,i upload a new cmd.jsp by benhider,i can see the new cmd.jsp in file manager of behinder,but it returns 404,no matter i use behinder or browser to connect cmd.jsp,i do not understand,please give me a hand,thanks so much.

老哥知道vcenter 的密码是存在哪里的吗

afaik there's no parameter in there, just a POST method ...
sorry i am bad at java

[*] Check https://192.168.1.13 is vul ...
[!] https://192.168.1.13 IS vul ...
[+] Identified: VMware vCenter Server 6.7.0 build-8170161 good

这是什么意思 修复了吗

/usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/NUMBER/0/h5ngc.war/resources/
why you choosed NUMBER=41 in tar file? it depends of what?

搭了个环境试了一下，版本如下。

看了一下vCenterServer，文件是有上传成功的。

重启vCenterServer后等待一段时间还是访问不到这个文件。

时版本对不上吗？还是哪里操作有误 o.0?

I got 200 Success response. Could you possibly provide steps how can I access shell.jsp?

What is next step?

I test on vcenter server 6.7.0-10244745 ,but it returns 401 when visit "https://VCIP/ui/vropspluginui/rest/services/uploadova",what's the problem?