CVE-2020-9047

usage: CVE-2020-9047.py [-h] [-p RPORT] [-s LPORT] [--command] [-d WEBDIR]
                        [-U USERNAME] [-P PASSWORD]
                        {WINDOWS,LINUX,CHECK} RHOST LHOST PAYLOAD

Exploit for exacqVision Web Service as outlined in CVE-2020-9047. This program
targets Windows and Linux x86 installations of exacqVision Web Service
versions 3.8.2.67295 - 20.06.3.0. Written by Michael W. Norris.

positional arguments:
  {WINDOWS,LINUX,CHECK}
                        The target operating system. Provide "WINDOWS" for
                        Windows, "LINUX" for Linux, or "CHECK" to have this
                        program perform a check. When using "CHECK", '' can be
                        provided for the LHOST and PAYLOAD arguments.
  RHOST                 The IP address of the remote host; the IP address of
                        the target.
  LHOST                 The local IP address that will serve the payload for
                        the remote host. This should not be "localhost" or
                        "127.0.0.1". The remote host will need to be able to
                        connect to the provided IP address. This program
                        should be run on the system with the specified IP
                        address.
  PAYLOAD               The absolute file path of an existing Windows
                        executable (.exe) or Linux binary file on the local
                        system. The binary will be executed on the remote
                        host. If the --command flag is set and "LINUX" was
                        provided as the TARGET argument, enter a command that
                        will be executed on the remote host.

optional arguments:
  -h, --help            show this help message and exit
  -p RPORT              The port on the remote host where exacqVision Web
                        Service is running. Default: 80
  -s LPORT              The local port that will be used to serve the payload
                        file for the remote host. Default: 8000
  --command             Sets the command flag. The flag allows for a command
                        to be provided as the PAYLOAD argument instead of a
                        file path to a binary. The provided command will be
                        executed on the remote host. The flag should be set
                        only if "LINUX" was provided as the TARGET argument.
  -d WEBDIR             The local existing directory where a randomly named
                        temporary directory will be created. Default: /tmp
  -U USERNAME           The username for authenticating to the remote
                        exacqVision Web Service application. Default: admin
  -P PASSWORD           The password for authenticating to the remote
                        exacqVision Web Service application. Default: admin256