bassmaster-rce

bassmaster-rce 通过注入任意 JavaScript 来利用 CVE-2014-7205，从而实现远程代码执行（Remote Code Execution）。 我偶然发现了 LuuPhu 的这篇文章（用越南语撰写）。既然我写过一些 NodeJS 代码，却从未尝试过对其进行漏洞利用，我想何不今天就试试呢？ Python PoC 包含两种反弹 Shell： 1. 一个简单的 NC 反弹 Shell 2. 一个"简单"的 NodeJS 反弹 Shell，取自 Riyaz Walikar 的 ibreak.software 免责声明 为求内容完整：...

CVE-2014-7205

creationtimestamp| type| source ---|---|--- 2016-11-02 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/40689 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/bassmasterjsinjection.rb 2025-02-06 03:13:42+00:00|...

Bassmaster 1.5.1 - Batch Arbitrary JavaScript Injection Remote Code Execution (Metasploit)

require 'msf/core' class MetasploitModule 'Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution', 'Description' = %q This module exploits an un-authenticated code injection vulnerability in the bassmaster nodejs plugin for hapi. The vulnerability is within the batch endpoint and...

Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution

require 'msf/core' class MetasploitModule 'Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution', 'Description' = %q This module exploits an un-authenticated code injection vulnerability in the bassmaster nodejs plugin for hapi. The vulnerability is within the batch endpoint and...

Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution Exploit

This module exploits an un-authenticated code injection vulnerability in the bassmaster nodejs plugin for hapi. The vulnerability is within the batch endpoint and allows an attacker to dynamically execute JavaScript code on the server side using an eval. Note that the code uses a '\x2f' character...

CVE-2014-7205

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors...