mind2hex/cve-2021-31630-openplc-3-authenticated-rceOpenPLC 3 WebServer Authenticated Remote Code Execution.
Execução Remota de Código Autenticada no Servidor Web OpenPLC 3.
A presença de Injeção de Comandos no Open PLC Webserver v3 permite que atacantes remotos executem código arbitrário ao explorar o componente "Hardware Layer Code Box" encontrado na página "/hardware" da aplicação. Testado apenas na máquina Wifinetictwo.htb do hackthebox.
usage: openplc_exploit.py [-h] [--usage] --ip ADDR --port PORT --target URL -U USER -P PASSWORD
[--payload-program PAYLOAD_PROGRAM]
options:
-h, --help show this help message and exit
--usage show usage message
--ip ADDR ip address for the reverse connection
--port PORT port number to the reverse connection
--target URL target url. Example: http://localhost:8080
-U USER, --username USER
username to log int to openplc web server
-P PASSWORD, --password PASSWORD
password to log in to openplc web server
--payload-program PAYLOAD_PROGRAM
structured text openplc format to send to /upload-program