378 matches found
ipfire-2-25-auth-rce
Ipfire 2-25 core update 156 인증된 RCE 패킷 설치 시 시스템 명령 실행 시스템이 HTML만으로 7zip을 가져옴 그리고 tmp 디렉터리 확인 버전 2.25 - core update 156 ipfire는 로그인 후 nobody 권한으로 임의의 OS 명령 실행을 허용함 루트가 되자! SUID 바이너리 확인 백업 프로그램이 다른 스크립트를 실행함. /var/ipfire/backup/bin/backup.pl bash 스크립트이며 권한이 매우 좋아 보임 bash 스크립트에 쓰기를 시도함. 오류 없음. 좋음!...
CVE-2014-6271-IPFire
CVE-2014-6271 CVE-2014-6271의 Python 구현: IP Fire =2.15 ShellShock RCE 동일한 익스플로잇에 대한 Metasploit 모듈 기반 EDB ID: 34839 익스플로잇은 자동입니다. 전체 스위치 목록은 ./CVE-2014-6271.py --help를 참조하세요 경고: 이 저장소의 코드는 학술/윤리적 목적으로만 사용될 수 있습니다. 저자는 이 익스플로잇을 다른 목적으로 사용하는 것을 용납하지 않습니다 -- 이 코드는 귀하가 소유하거나 테스트 권한을 부여받은 시스템에 대해서만 사용할 ...
IPFire_2.25_RCE_Authenticated
IPFire 2.25 원격 코드 실행 인증됨 - CVE-2021-33393 본 익스플로잇은 CVE-2021-33393 https://nvd.nist.gov/vuln/detail/CVE-2021-33393을 기반으로 하며, Mücahit Saratar https://github.com/KaanaryOverFlow/ipfire-2-25-auth-rce의 원본 익스플로잇을 확장하여 루트 권한으로 리버스 셸을 획득합니다. 사용법 리스너 시작: nc -lvnp 4444 익스플로잇 실행: python exploit.py...
IPFire_2.19_RCE_Authenticated
IPFire 2.19 OINKCODE RCE PoC IPFire 2.19 の ids.cgi ページにおける OINKCODE パラメータを介した認証を必要とするコマンドインジェクション脆弱性の Python 製概念実証 PoC です。 認可されたセキュリティテストおよびトレーニングラボのみを対象としています。 この PoC は、自分が所有しているか、明示的なテスト許可を得たシステムに対してのみ実行してください。作者は、このコードによって引き起こされた誤用や損害について一切責任を負いません。 脆弱性の概要 IPFire 2.19 は、/cgi-bin/ids.cgi...
Exploit for CVE-2021-33393
IPFire2.25RCEAuthenticated This exploit is based on CVE-202...
CVE-2019-25399
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...
CVE-2019-25400
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grpname, remark, SRVNAME, SRVPORT,...
CVE-2019-25399
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...
CVE-2019-25400
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grpname, remark, SRVNAME, SRVPORT,...
CVE-2019-25398
IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. Attackers can submit POST requests with script payloads in parameters like VPNIP, DMTU, ccdname,...
CVE-2019-25398
IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. Attackers can submit POST requests with script payloads in parameters like VPNIP, DMTU, ccdname,...
CVE-2019-25397
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to...
CVE-2019-25397
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to...
CVE-2019-25396
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. Attackers can submit crafted requests with script payloads in the MAXDISKUSAGE or MAXDOWNLOADRATE paramete...
CVE-2019-25396
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. Attackers can submit crafted requests with script payloads in the MAXDISKUSAGE or MAXDOWNLOADRATE paramete...
CVE-2019-25400 IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grpname, remark, SRVNAME, SRVPORT,...
CVE-2019-25400
CVE-2019-25400 affects IPFire 2.21 Core Update 127. The vulnerabilities are multiple reflected XSS in the fwhosts.cgi script, exploitable via numerous parameters (e.g., HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp_name, remark, SRV_NAME, SRV_PORT, SRVGRP_NAME, SRVGRP_REMARK, updatesr...
CVE-2019-25400 IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grpname, remark, SRVNAME, SRVPORT,...
CVE-2019-25399 IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...
CVE-2019-25399 IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...