ns-sp4ce / cve-2021-21972

CVE-2021-21972 Exploit

CVE-2021-21972

CVE-2021-21972

Works On

• VMware-VCSA-all-6.7.0-8217866、VMware-VIM-all-6.7.0-8217866 ✔
• VMware-VCSA-all-6.5.0-16613358 ✔

For vCenter6.7 U2+

vCenter 6.7U2+ running website in memory,so this exp can't work for 6.7 u2+.

Need test

• vCenter 6.5 Linux(VCSA)/Window Waiting For Test
• vCenter 6.7 Linux(VCSA)/Window Waiting For Test
• vCenter 7.0 Linux(VCSA)/Window Waiting For Test

Details

1. 漏洞为任意文件上传
2. 存在问题的接口为/ui/vropspluginui/rest/services/uploadova，完整路径（https://domain.com/ui/vropspluginui/rest/services/uploadova）
3. 仓库内的payload文件夹内的tar文件为默认冰蝎3 webshell

Screenshots

Runtime

Success

声明

• 工具仅用于安全人员安全测试与研究使用，任何未授权检测造成的直接或者间接的后果及损失，均由使用者本人负责。
• The tool is only used for security testing and research by security personnel. Any direct or indirect consequences and losses caused by unauthorized testing are the responsibility of the user.

cve-2021-21972's Issues

401 problem

I test on vcenter server 6.7.0-10244745 ,but it returns 401 when visit "https://VCIP/ui/vropspluginui/rest/services/uploadova",what's the problem?

JSP base directory probably not generic

Hello,
Thanks for the PoC, I aws looking at Linux.tar file that contains the directory where the webshell should be written.
By testing on 6.7 unpatched servers, it's not getting JSP compilation/execution that easily (and strace/find does not give up that easily a proper webapps path).

Cheers

windows下没有h5ngc.war目录

How to know Get respone 405 - url is vul?

Can you explant it?

有个问题请教下

老哥知道vcenter 的密码是存在哪里的吗

提示成功，访问404

RT:

C:\Users\test\Desktop\CVE-2021-21972-main>python CVE-2021-21972.py -url 10.10.10.10

            Test On vCenter 6.5 Linux/Windows
                    By: Sp4ce
                    Github:https://github.com/NS-Sp4ce

[] Check https://10.10.10.10 is vul ...
[!] https://10.10.10.10 IS vul ...
[] Trying linux payload...
[+] Shell upload success, now check is shell exist...
[-] Shell upload success, BUT NOT EXIST, trying windows payload...

C:\Users\test\Desktop\CVE-2021-21972-main>

---

手动上传tar包测试，linux的返回“SUCCESS”，windows返回“FAILED”
但是访问shell地址还是404

访问不到上传的webshell

搭了个环境试了一下，版本如下。

看了一下vCenterServer，文件是有上传成功的。

重启vCenterServer后等待一段时间还是访问不到这个文件。

时版本对不上吗？还是哪里操作有误 o.0?

试图复现你个人网站上针对6.7 u2+版本的测试，请问您能否提供h5ngv.war?

额外，利用CVE-2021-21792 漏洞回传 vCener 服务器进行复写操作的地址是什么呢？

[+] Identified: VMware vCenter Server 7.0.1 build-17005016 good
[-] vCenter 6.7U2+ running website in memory, so this exp can't work for 6.7 u2+.

你好

[*] Check https://192.168.1.13 is vul ...
[!] https://192.168.1.13 IS vul ...
[+] Identified: VMware vCenter Server 6.7.0 build-8170161 good

这是什么意思 修复了吗

how can I access uploaded shell?

I got 200 Success response. Could you possibly provide steps how can I access shell.jsp?

What is next step?

404 Problem

after I connect to the webshell with Behinder,i upload a new cmd.jsp by benhider,i can see the new cmd.jsp in file manager of behinder,but it returns 404,no matter i use behinder or browser to connect cmd.jsp,i do not understand,please give me a hand,thanks so much.

number of folder

/usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/NUMBER/0/h5ngc.war/resources/
why you choosed NUMBER=41 in tar file? it depends of what?

how to interact with the webshell ?

afaik there's no parameter in there, just a POST method ...
sorry i am bad at java