Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
bladelogic_bmc-cve-2016-1542 — A rebuilt version of the exploit for CVE-2016-1542 and CVE-2016-1543 from insinuator.net | Kitploit
Tools/GitHubGitHub/patriknordlen/bladelogic_bmc-cve-2016-1542
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubpatriknordlen/bladelogic_bmc-cve-2016-1542

bladelogic_bmc-cve-2016-1542

A rebuilt version of the exploit for CVE-2016-1542 and CVE-2016-1543 from insinuator.net

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
19 years agoNot yet reviewed

bladelogic_bmc-cve-2016-1542

A rebuilt version of the exploit for CVE-2016-1542 and CVE-2016-1543 from insinuator.net (https://insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/)

I recently came across systems vulnerable to this CVE in a recent penetration test and found exploits from insinuator - however for unknown reasons (change in Python requests functionality in newer versions?) the exploit wasn't working properly.

XMLRPC communication with the RSCD agent is done by:

  • Connecting to the agent on port 4750 and send "TLSRPC" in cleartext
  • Set up an SSL session
  • Send any subsequent data through the established SSL session

The insinuator PoC code tries to do this by setting up a socket that's SSL wrapped and then have urllib3 use that but some functionality in that seems to have changed in later versions. Looking around I found this stackoverflow post with code that seems oddly familiar. :)

The answer there was to use a custom transport adapter. Actually doing this was surprisingly complex (to me at least) for just being able to send 7 characters of cleartext before establishing an SSL connection, so I thought I might as well share what I came up with. Hopefully it works for others as well.

Download Tool