bassmaster-rce

bassmaster-rce CVE-2014-7205を悪用し、任意のJavaScriptを注入することでリモートコード実行（RCE）を実現します。 私はLuuPhuによるこの投稿（ベトナム語）を見つけました。NodeJSでコードを書いたことはありますが、それを悪用したことはなかったので、今日やってみようと思いました。 Python PoCには2種類のリバースシェルが含まれています： 1. シンプルなNCリバースシェル 2. Riyaz Walikarのibreak.softwareから引用した「シンプルな」NodeJSリバースシェル 免責事項 完全性のために：...

CVE-2014-7205

creationtimestamp| type| source ---|---|--- 2016-11-02 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/40689 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/bassmasterjsinjection.rb 2025-02-06 03:13:42+00:00|...

Bassmaster 1.5.1 - Batch Arbitrary JavaScript Injection Remote Code Execution (Metasploit)

require 'msf/core' class MetasploitModule 'Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution', 'Description' = %q This module exploits an un-authenticated code injection vulnerability in the bassmaster nodejs plugin for hapi. The vulnerability is within the batch endpoint and...

Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution

require 'msf/core' class MetasploitModule 'Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution', 'Description' = %q This module exploits an un-authenticated code injection vulnerability in the bassmaster nodejs plugin for hapi. The vulnerability is within the batch endpoint and...

Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution Exploit

This module exploits an un-authenticated code injection vulnerability in the bassmaster nodejs plugin for hapi. The vulnerability is within the batch endpoint and allows an attacker to dynamically execute JavaScript code on the server side using an eval. Note that the code uses a '\x2f' character...

CVE-2014-7205

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors...