Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Zena-CVE-2021-45026 | Kitploit
Tools/GitHubGitHub/jetp1ane/zena-cve-2021-45026
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHubjetp1ane/zena-cve-2021-45026

Zena-CVE-2021-45026

View Repository
414 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Zena - Stored XSS to RCE Exploit POC

Exploit POC for Rocket Software's Zena application v. 4.2.1 - Stored XSS to RCE

CVE-2021-45025

CVE-2021-45026

https://phoenix-sec.io/2022/06/17/Zena-CookieMonsteRCE.html

POC Process:

  • Logs into Zena's webconfig page using default credentials
  • Drops Stored XSS payload
  • Payload needs to be triggered by someone navigating to the webconfig page
  • Triggered payload uses REST API backend of Zena to find an agent and build a Task for that agent
  • Task is then triggered for agent thus executing the specified command

To Run:

  • python CookieMonster.py <hostname/ip> <TLS/SSL - True or False> <cmd.exe command>
    • Example: python3 CookieMonster.py 127.0.0.1 False "/c whoami > c:/out.txt"
Download Tool