关联漏洞
标题:Microsoft Azure 授权问题漏洞 (CVE-2021-38647)Description:Microsoft Azure是美国微软（Microsoft）公司的一套开放的企业级云计算平台。 Microsoft Azure Open Management Infrastructure存在授权问题漏洞。以下产品和版本受到影响：Azure Open Management Infrastructure <omi-1.6.8-1。
Description
OMIGOD PoC
介绍
# OMIGOD PoC
## Usage
```
$ go run CVE-2021-38647.go -h
USAGE: go run CVE-2021-38647.go [FLAGS]
-c string
Command to run.
-p int
Remote WSMan port. (default 5986)
-t string
IP address of the vulnerable server.
```
## Docker
To build docker container:
```
docker build -t "microsoft/omi" .
```
To run docker container:
```
docker run --name omi_poc -p 5985:5985 -p 5986:5986 microsoft/omi
```
To stop docker container:
```
docker stop omi_poc
```
To connect into docker container:
```
docker exec -it omi_poc /bin/bash
```
## References
* https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution
* https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
* https://github.com/microsoft/omi
* https://twitter.com/GossiTheDog/status/1437896101756030982
* https://msrc-blog.microsoft.com/2021/09/16/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/
* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647
* https://rootsecdev.medium.com/creating-your-own-private-pwn-lab-for-omi-exploitation-b6919fc63956
* https://attackerkb.com/topics/08O94gYdF1/cve-2021-38647
文件快照
[4.0K] /data/pocs/a87daab04515b9f9d88dfd5835dd4f30057dd110
├── [3.7K] CVE-2021-38647.go
├── [ 949] Dockerfile
└── [1.2K] README.md
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 本地 POC 快照面向订阅用户开放；当原始来源失效或无法访问时，本地镜像作为订阅权益的一部分提供。
3. 持续抓取、验证、维护这份 POC 档案需要不少投入，因此本地快照已纳入付费订阅。您的订阅是让这份资料能继续走下去的关键，由衷感谢。 查看订阅方案 →