<gh_stars>1-10
#!/bin/python3

import socket
import sys
import paramiko
import re
import getpass


class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'


def ssh_test(vcenter, port):
    print("Testing the vCenter IP: " + vcenter)
    try:
        s.connect((vcenter, port))
        if s.recv(1024) != "":
            print(bcolors.OKGREEN + "SSH is open on the host" + bcolors.ENDC)

    except:
        print(bcolors.FAIL + "Port 22 is closed on the target. Please enable." + bcolors.ENDC)
        sys.exit()

def vuln_check(vcenter):
    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.load_system_host_keys()
    username = 'root'
    print("Please enter your VCSA root password")
    password = get<PASSWORD>.getpass()
    try:
        ssh.connect(vcenter, username=username, password=password)
    except:
        print(bcolors.WARNING + "Bad password" + bcolors.ENDC)
        sys.exit()
    print("Checking if you upgraded from 6.0 or 6.5")
    ssh_stdin, ssh_stdout, ssh_stderr = ssh.exec_command("shell ls /var/log/vmware/upgrade/ | grep CollectRequirements_com.vmware.sso")
    output = ssh_stdout.read()
    output = output.splitlines()
    output = output[0]
    output = output.rstrip().decode("utf-8")
    if output != "Shell access is granted to root":
        print("Found upgrade logs")
        ssh.connect(vcenter, username=username, password=password)
        ssh_stdin, ssh_stdout, ssh_stderr = ssh.exec_command("shell cat /var/log/vmware/upgrade/CollectRequirements_com.vmware.sso*.log")
        output = ssh_stdout.read()
        output = output.rstrip().decode("utf-8")
        version_check = re.findall("'sourceVcVersion':\s'6.([05])'", output)
        if version_check == "":
            print("You did not upgrade from version 6.0 or 6.5. You are not vulnerable")
            sys.exit()
        else:
            ssh.connect(vcenter, username=username, password=password)
            ssh_stdin, ssh_stdout, ssh_stderr = ssh.exec_command('com.vmware.appliance.version1.system.version.get')
            output = ssh_stdout.read(size=None)
            output_clean = output.rstrip().decode("utf-8")
            vcenter_version = re.findall('Build:\s([0-9]+)', output_clean)
            if int(vcenter_version[0]) < 15976714 and int(vcenter_version[0]) > 8217866:
                print(bcolors.FAIL + "You upgraded from version 6." + version_check[0] +" and you are not on patch 6.7U3f. You are vulnerable." + bcolors.ENDC)
                sys.exit()
            else:
                print(bcolors.OKGREEN + "You are not running a vulnerable version of vCenter" + bcolors.ENDC)
                sys.exit()
    else:
        print(bcolors.OKGREEN + "No upgrade logs found. You deployed to 6.7. You are not vulnerable." + bcolors.ENDC)
    ssh.close()


if __name__ == '__main__':
    if len(sys.argv) == 2:
        target = socket.gethostbyname(sys.argv[1])
    else:
        print("Invalid arguments")
        print("Syntax: python3 CVE-2020-3952.py <hostname>")
        sys.exit()
    s = socket.socket()
    port = 22
    ssh_test(target, port)
    vuln_check(target)
#!/bin/python3

import socket
import sys
import paramiko
import re
import getpass


class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'


def ssh_test(vcenter, port):
    print("Testing the vCenter IP: " + vcenter)
    try:
        s.connect((vcenter, port))
        if s.recv(1024) != "":
            print(bcolors.OKGREEN + "SSH is open on the host" + bcolors.ENDC)

    except:
        print(bcolors.FAIL + "Port 22 is closed on the target. Please enable." + bcolors.ENDC)
        sys.exit()

def vuln_check(vcenter):
    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.load_system_host_keys()
    username = 'root'
    print("Please enter your VCSA root password")
    password = get<PASSWORD>.getpass()
    try:
        ssh.connect(vcenter, username=username, password=password)
    except:
        print(bcolors.WARNING + "Bad password" + bcolors.ENDC)
        sys.exit()
    print("Checking if you upgraded from 6.0 or 6.5")
    ssh_stdin, ssh_stdout, ssh_stderr = ssh.exec_command("shell ls /var/log/vmware/upgrade/ | grep CollectRequirements_com.vmware.sso")
    output = ssh_stdout.read()
    output = output.splitlines()
    output = output[0]
    output = output.rstrip().decode("utf-8")
    if output != "Shell access is granted to root":
        print("Found upgrade logs")
        ssh.connect(vcenter, username=username, password=password)
        ssh_stdin, ssh_stdout, ssh_stderr = ssh.exec_command("shell cat /var/log/vmware/upgrade/CollectRequirements_com.vmware.sso*.log")
        output = ssh_stdout.read()
        output = output.rstrip().decode("utf-8")
        version_check = re.findall("'sourceVcVersion':\s'6.([05])'", output)
        if version_check == "":
            print("You did not upgrade from version 6.0 or 6.5. You are not vulnerable")
            sys.exit()
        else:
            ssh.connect(vcenter, username=username, password=password)
            ssh_stdin, ssh_stdout, ssh_stderr = ssh.exec_command('com.vmware.appliance.version1.system.version.get')
            output = ssh_stdout.read(size=None)
            output_clean = output.rstrip().decode("utf-8")
            vcenter_version = re.findall('Build:\s([0-9]+)', output_clean)
            if int(vcenter_version[0]) < 15976714 and int(vcenter_version[0]) > 8217866:
                print(bcolors.FAIL + "You upgraded from version 6." + version_check[0] +" and you are not on patch 6.7U3f. You are vulnerable." + bcolors.ENDC)
                sys.exit()
            else:
                print(bcolors.OKGREEN + "You are not running a vulnerable version of vCenter" + bcolors.ENDC)
                sys.exit()
    else:
        print(bcolors.OKGREEN + "No upgrade logs found. You deployed to 6.7. You are not vulnerable." + bcolors.ENDC)
    ssh.close()


if __name__ == '__main__':
    if len(sys.argv) == 2:
        target = socket.gethostbyname(sys.argv[1])
    else:
        print("Invalid arguments")
        print("Syntax: python3 CVE-2020-3952.py <hostname>")
        sys.exit()
    s = socket.socket()
    port = 22
    ssh_test(target, port)
    vuln_check(target)
#!/bin/python3