PoC

PoC 概念実証エクスプロイトとツールのリポジトリ。 BMCRSCDRCE BMC Server AutomationのRSCDエージェントに対する認証なしリモートコマンド実行エクスプロイト。このエクスプロイトは、CVE-2016-1542（Nessusにより検出）の影響を受けるサーバーに対して動作します。 これは現在Metasploitモジュールになっています。exploits/multi/misc/bmcserverautomationrscdnshrce を参照してください。...

bladelogic_bmc-cve-2016-1542

bladelogicbmc-cve-2016-1542 针对 CVE-2016-1542 和 CVE-2016-1543 从 insinuator.net https://insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/ 重建的利用代码 我最近在一次渗透测试中遇到了易受此 CVE 影响的系统，并找到了来自 insinuator 的利用代码——但出于未知原因（Python requests 功能在较新版本中的变化？），该利用代码无法正常工作。 与 RSCD 代理的 XMLRPC 通信通过以下步骤完成...

BMC BladeLogic 8.3.00.64 - Remote Command Execution

Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version Filename: BMCrexec.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-24 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: BMC RSCD agent 8.3.00.64 CVE: CVE-2016-1542...

BMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure

Exploit Title: BMC BladeLogic RSCD agent get Windows users Filename: BMCwinUsers.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-27 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: BMC RSCD agent 8.3.00.64 CVE: CVE-2016-5063 Vendor...

BMC Server Automation RSCD Agent - NSH Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BMC Server Automation RSCD Agent NSH Remote ' \ 'Command Execution', 'Description' = %q This module exploits a weak access control check in the B...

BMC Server Automation RSCD Agent NSH Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BMC Server Automation RSCD Agent NSH Remote ' \ 'Command Execution', 'Description' = %q This module exploits a weak access control check in the B...

BMC BladeLogic RSCD Agent 8.3.00.64 Windows Users Disclosure

Exploit Title: BMC BladeLogic RSCD agent get Windows users Filename: BMCwinUsers.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-27 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: BMC RSCD agent 8.3.00.64 CVE: CVE-2016-5063 Vendor...

BMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure

BMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure Exploit Title: BMC BladeLogic RSCD agent get Windows users Filename: BMCwinUsers.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-27 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog...

BMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure Exploit

Exploit for windows platform in category web applications Exploit Title: BMC BladeLogic RSCD agent get Windows users Filename: BMCwinUsers.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-27 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version...

BMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure

Exploit Title: BMC BladeLogic RSCD agent get Windows users Filename: BMCwinUsers.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-27 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: BMC RSCD agent 8.3.00.64 CVE: CVE-2016-5063 Vendor...

BMC BladeLogic 8.3.00.64 - Remote Command Execution

BMC BladeLogic 8.3.00.64 - Remote Command Execution Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version Filename: BMCrexec.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-24 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog...

BMC BladeLogic 8.3.00.64 Remote Command Execution

Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version Filename: BMCrexec.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-24 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: BMC RSCD agent 8.3.00.64 CVE: CVE-2016-1542...

Authorization

The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors...

CVE-2016-5063

The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors...

CVE-2016-5063

The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors...

CVE-2016-5063

CVE-2016-5063 affects the Windows RSCD agent in BMC Server Automation prior to 8.6 SP1 Patch 2 and 8.7 prior to Patch 3. The issue allows remote attackers to bypass authorization and invoke RPC calls via unspecified vectors. Public exploit materials exist (e.g., Exploit-DB 43934) showing Windows ...

BMC Server Automation RSCD Agent Weak ACL NSH Arbitrary Command Execution

Binary data bmcrscdnshaclcheck.nbin...

CVE-2016-1542

The RPC API in RSCD agent in BMC BladeLogic Server Automation BSA 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure...

CVE-2016-1542

CVE-2016-1542/1543 affect the BMC BladeLogic Server Automation RSCD agent RPC/XMLRPC interface (Linux/UNIX) across 8.2–8.7. The flaws enable remote bypass of authorization and user-related abuse: CVE-2016-1542 allows user enumeration after an auth failure; CVE-2016-1543 permits bypass of authoriz...

CVE-2016-1543

CVE-2016-1543 affects BMC BladeLogic Server Automation RSCD agent (Linux/UNIX) across 8.2.x–8.7.x. The RPC API allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure. Public exploitation exists (NSH r...