CVE-2024-4956

This repository contains a Python utility for automating the exploitation of CVE-2024-4956 and is capable of mass testing file paths from an input file while automating the process of saving existing file path contents to disk for analysis. Details for the vulnerability can be found here.

Usage

usage: cve-2024-4956.py [-h] [-f FILE] [-p PROXY] -u URL [--test] [-r RELATIVE_PATH]

CVE-2024-4956 Path Traversal Exploit Script

options:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  Path to the text file containing a list of relative file paths to test based on the Nexus server installation path
  -p PROXY, --proxy PROXY
                        HTTP proxy string to use for requests (e.g. http://localhost:8080)
  -u URL, --url URL     Base URL of the target server
  --test                Run the program in test mode to check for directory traversal vulnerability, then exit
  -r RELATIVE_PATH, --relative-path RELATIVE_PATH
                        Relative path for traversal tests (paths in the file provided to -f will be underneath this path)

Shiro1Extractor

A script for automating the extraction of Apache Shiro 1 hashes from OrientDB .pcl files is available here for extracting/gathering hashes to use with the Hashcat module.

Hashcat Module

I have developed a custom Apache Shiro 1 hashcat module while the official project is still lacking support for the algorithm. It is available at my hashcat fork here. You can take the hashes extracted using this program and use them directly with the module. Here are the steps to use it:

Clone the repository
Build it from source
Module is accessible using mode 12150

I have submitted a pull request to the official Hashcat project, hopefully it will get merged and the module will be available via the official Hashcat repository! A blog was created for the creation of the Hashcat module and is available here.

Shiro1Tools

This repository contains useful tools that were used when creating the Hashcat module for Apache Shiro 1 such as a standalone C program that cracks Apache Shiro 1 hashes using OpenSSL and a Java application for generating Apache Shiro 1 hashes.

Disclaimer