echo is not found

[Kali95739]

I feel its something in my py environment all though all requirements installed numpy and echo as well it still outputs that could it be with python environment?

[Kali95739]

Whats ur python version?

[Kali95739]

@l0n3m4n

[l0n3m4n]

its python3

[Kali95739]

The version number my friend

[BTuguldur]

update.txt
worrking

[Kali95739]

Question I go and add the admin admin123 into vcenter_creds.txt and then user2base64.sh I am still getting authentication failed could it be my connection or ssh binary ?

[sec13b]

i have same error :
Error: name 'echo' is not defined

┌──(venv)─(kali㉿kali)-[~/Desktop/CVE-2024-22274-RCE]
└─$ python3 CVE-2024-22274-RCE.py -t 192.168.150.71 -P 22 -p payload.txt -c vcenter_creds.txt
/home/kali/Desktop/CVE-2024-22274-RCE/CVE-2024-22274-RCE.py:66: SyntaxWarning: invalid escape sequence '\_'
  {Style.RESET_ALL}"""

 ___ ___ _______                                          ______               __                                                                                                                                                          
|   |   |   |   |.--.--.--.---.-.----.-----.______.--.--.|      |.-----.-----.|  |_.-----.----.                                                                                                                                            
|   |   |       ||  |  |  |  _  |   _|  -__|______|  |  ||   ---||  -__|     ||   _|  -__|   _|                                                                                                                                            
 \_____/|__|_|__||________|___._|__| |_____|       \___/ |______||_____|__|__||____|_____|__|                                                                                                                                              
                                                                                                                                                                                                                                           
                Author: l0n3m4n | vCenter RCE: CVE-2024-22274 | PoC: @mbadanoiu                                                                                                                                                            
                                                                                                                                                                                                                                           
[-] Error: name 'echo' is not defined
                                                                                                                                                                                                                                           
┌──(venv)─(kali㉿kali)-[~/Desktop/CVE-2024-22274-RCE]

┌──(venv)─(kali㉿kali)-[~/Desktop/CVE-2024-22274-RCE]
└─$ python3 --version                                                                        
Python 3.12.6                                                                                                                                                                                                                                           
┌──(venv)─(kali㉿kali)-[~/Desktop/CVE-2024-22274-RCE]
└─$ 

i dont have the port 22 open.
192.168.150.71 80, 443, 902

[sec13b]

[-] Error: Bad authentication type; allowed types: ['publickey', 'keyboard-interactive']

import sys
import logging
logging.basicConfig(stream=sys.stderr, level=logging.DEBUG)

Log:

DEBUG:invoke:Didn't see any /etc/invoke.yaml, skipping.
DEBUG:invoke:Didn't see any /etc/invoke.yml, skipping.
DEBUG:invoke:Didn't see any /etc/invoke.json, skipping.
DEBUG:invoke:Didn't see any /home/kali/.invoke.yaml, skipping.
DEBUG:invoke:Didn't see any /home/kali/.invoke.yml, skipping.
DEBUG:invoke:Didn't see any /home/kali/.invoke.json, skipping.
DEBUG:invoke:Merging config sources in order onto new empty _config...
DEBUG:invoke:Defaults: {'run': {'asynchronous': False, 'disown': False, 'dry': False, 'echo': False, 'echo_stdin': None, 'encoding': None, 'env': {}, 'err_stream': None, 'fallback': True, 'hide': None, 'in_stream': None, 'out_stream': None, 'echo_format': '\x1b[1;37m{command}\x1b[0m', 'pty': False, 'replace_env': False, 'shell': '/bin/bash', 'warn': False, 'watchers': []}, 'runners': {'local': <class 'invoke.runners.Local'>}, 'sudo': {'password': None, 'prompt': '[sudo] password: ', 'user': None}, 'tasks': {'auto_dash_names': True, 'collection_name': 'tasks', 'dedupe': True, 'executor_class': None, 'ignore_unknown_help': False, 'search_root': None}, 'timeouts': {'command': None}}
DEBUG:invoke:Collection-driven: {}
DEBUG:invoke:System-wide config file (/etc/invoke.py): {}
DEBUG:invoke:Per-user config file (/home/kali/.invoke.py): {}
DEBUG:invoke:Per-project config file has not been loaded yet, skipping
DEBUG:invoke:Environment variable config: {}
DEBUG:invoke:Runtime config file has not been loaded yet, skipping
DEBUG:invoke:Overrides: {}
DEBUG:invoke:Modifications: {}
DEBUG:invoke:Deletions: {}
DEBUG:invoke:Didn't see any /etc/fabric.yaml, skipping.
DEBUG:invoke:Didn't see any /etc/fabric.yml, skipping.
DEBUG:invoke:Didn't see any /etc/fabric.json, skipping.
DEBUG:invoke:Didn't see any /home/kali/.fabric.yaml, skipping.
DEBUG:invoke:Didn't see any /home/kali/.fabric.yml, skipping.
DEBUG:invoke:Didn't see any /home/kali/.fabric.json, skipping.
DEBUG:invoke:Merging config sources in order onto new empty _config...
DEBUG:invoke:Defaults: {'run': {'asynchronous': False, 'disown': False, 'dry': False, 'echo': False, 'echo_stdin': None, 'encoding': None, 'env': {}, 'err_stream': None, 'fallback': True, 'hide': None, 'in_stream': None, 'out_stream': None, 'echo_format': '\x1b[1;37m{command}\x1b[0m', 'pty': False, 'replace_env': False, 'shell': '/bin/bash', 'warn': False, 'watchers': []}, 'runners': {'local': <class 'invoke.runners.Local'>, 'remote': <class 'fabric.runners.Remote'>, 'remote_shell': <class 'fabric.runners.RemoteShell'>}, 'sudo': {'password': None, 'prompt': '[sudo] password: ', 'user': None}, 'tasks': {'auto_dash_names': True, 'collection_name': 'fabfile', 'dedupe': True, 'executor_class': None, 'ignore_unknown_help': False, 'search_root': None}, 'timeouts': {'command': None, 'connect': None}, 'authentication': {'identities': [], 'strategy_class': None}, 'connect_kwargs': {}, 'forward_agent': False, 'gateway': None, 'inline_ssh_env': True, 'load_ssh_configs': True, 'port': 22, 'ssh_config_path': None, 'user': 'kali'}
DEBUG:invoke:Collection-driven: {}
DEBUG:invoke:System-wide config file (/etc/fabric.py): {}
DEBUG:invoke:Per-user config file (/home/kali/.fabric.py): {}
DEBUG:invoke:Per-project config file has not been loaded yet, skipping
DEBUG:invoke:Environment variable config: {}
DEBUG:invoke:Runtime config file has not been loaded yet, skipping
DEBUG:invoke:Overrides: {}
DEBUG:invoke:Modifications: {}
DEBUG:invoke:Deletions: {}
DEBUG:fabric:File not found, skipping
DEBUG:fabric:Loaded 2 new ssh_config rules from '/etc/ssh/ssh_config'
DEBUG:invoke:Merging config sources in order onto new empty _config...
DEBUG:invoke:Defaults: {'run': {'asynchronous': False, 'disown': False, 'dry': False, 'echo': False, 'echo_stdin': None, 'encoding': None, 'env': {}, 'err_stream': None, 'fallback': True, 'hide': None, 'in_stream': None, 'out_stream': None, 'echo_format': '\x1b[1;37m{command}\x1b[0m', 'pty': False, 'replace_env': False, 'shell': '/bin/bash', 'warn': False, 'watchers': []}, 'runners': {'local': <class 'invoke.runners.Local'>, 'remote': <class 'fabric.runners.Remote'>, 'remote_shell': <class 'fabric.runners.RemoteShell'>}, 'sudo': {'password': None, 'prompt': '[sudo] password: ', 'user': None}, 'tasks': {'auto_dash_names': True, 'collection_name': 'fabfile', 'dedupe': True, 'executor_class': None, 'ignore_unknown_help': False, 'search_root': None}, 'timeouts': {'command': None, 'connect': None}, 'authentication': {'identities': [], 'strategy_class': None}, 'connect_kwargs': {}, 'forward_agent': False, 'gateway': None, 'inline_ssh_env': True, 'load_ssh_configs': True, 'port': 22, 'ssh_config_path': None, 'user': 'kali'}
DEBUG:invoke:Collection-driven: {}
DEBUG:invoke:System-wide config file (/etc/fabric.py): {}
DEBUG:invoke:Per-user config file (/home/kali/.fabric.py): {}
DEBUG:invoke:Per-project config file has not been loaded yet, skipping
DEBUG:invoke:Environment variable config: {}
DEBUG:invoke:Runtime config file has not been loaded yet, skipping
DEBUG:invoke:Overrides: {}
DEBUG:invoke:Modifications: {'inline_ssh_env': True}
DEBUG:invoke:Deletions: {}
[+] Connected to 10.0.1.5 via SSH
DEBUG:paramiko.transport:starting thread (client mode): 0x73ed92e0
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_3.4.1
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-OpenSSH_7.3
INFO:paramiko.transport:Connected (version 2.0, client OpenSSH_7.3)
DEBUG:paramiko.transport:=== Key exchange possibilities ===
DEBUG:paramiko.transport:kex algos: curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1
DEBUG:paramiko.transport:server key: ssh-rsa, rsa-sha2-512, rsa-sha2-256
DEBUG:paramiko.transport:client encrypt: aes128-ctr, aes192-ctr, aes256-ctr, 3des-cbc
DEBUG:paramiko.transport:server encrypt: aes128-ctr, aes192-ctr, aes256-ctr, 3des-cbc
DEBUG:paramiko.transport:client mac: hmac-sha2-256, hmac-sha2-512, hmac-sha1
DEBUG:paramiko.transport:server mac: hmac-sha2-256, hmac-sha2-512, hmac-sha1
DEBUG:paramiko.transport:client compress: none, zlib@openssh.com
DEBUG:paramiko.transport:server compress: none, zlib@openssh.com
DEBUG:paramiko.transport:client lang: <none>
DEBUG:paramiko.transport:server lang: <none>
DEBUG:paramiko.transport:kex follows: False
DEBUG:paramiko.transport:=== Key exchange agreements ===
DEBUG:paramiko.transport:Kex: curve25519-sha256@libssh.org
DEBUG:paramiko.transport:HostKey: rsa-sha2-512
DEBUG:paramiko.transport:Cipher: aes128-ctr
DEBUG:paramiko.transport:MAC: hmac-sha2-256
DEBUG:paramiko.transport:Compression: none
DEBUG:paramiko.transport:=== End of kex handshake ===
DEBUG:paramiko.transport:kex engine KexCurve25519 specified hash_algo <built-in function openssl_sha256>
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Got EXT_INFO: {'server-sig-algs': b'rsa-sha2-256,rsa-sha2-512'}
DEBUG:paramiko.transport:Adding ssh-rsa host key for 10.0.1.5: b'6f70962106b842715ecb825f00388020'
DEBUG:paramiko.transport:userauth is OK
DEBUG:paramiko.transport:Authentication type (password) not permitted.
DEBUG:paramiko.transport:Allowed methods: ['publickey', 'keyboard-interactive']
DEBUG:paramiko.transport:userauth is OK
INFO:paramiko.transport:Authentication (keyboard-interactive) failed.
[-] Error: Bad authentication type; allowed types: ['publickey', 'keyboard-interactive']
                                                                                                            
┌──(kali㉿kali)-[~/Desktop/vmware/CVE-2024-22274-RCE]