IPFire_2.25_RCE_Authenticated

IPFire 2.25 远程代码执行（认证后） - CVE-2021-33393 此漏洞利用基于CVE-2021-33393（https://nvd.nist.gov/vuln/detail/CVE-2021-33393），并基于Mücahit Saratar（https://github.com/KaanaryOverFlow/ipfire-2-25-auth-rce）的原始漏洞利用构建，扩展了它以实现具有root权限的反向shell。 用法 启动监听器： nc -lvnp 4444 运行漏洞利用程序： python exploit.py https://192.168.0.10:44...

Exploit for CVE-2021-33393

IPFire2.25RCEAuthenticated This exploit is based on CVE-202...

CVE-2021-33393

lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the...

Metasploit Wrap-Up

I'm very Emby-ous Community contributor btnz-k has authored a new Emby Version Scanner module consisting of both an exploit and a scanner for the SSRF vulnerability found in Emby. Emby is a previously open source media server designed to organize, play, and stream audio and video to a variety of...

IPFire 2.25 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IPFire 2.25 Core Update 156 and Prior pakfire.cgi Authenticated RCE', 'Description' = %q This module exploits an authenticated command injection...

CVE-2021-33393

creationtimestamp| type| source ---|---|--- 2021-06-14 23:08:59+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ipfirepakfireexec.rb 2025-02-06 03:13:45+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:10:37+00:00| seen|...

CVE-2021-33393

IPFire 2.25-core155 contains an ownership/permissions issue in backup scripts (backup.pl) under /var/ipfire/backup, which can be exploited to execute code as root. Connected details show an authenticated command-injection path in pakfire.cgi used to achieve root-level RCE on IPFire 2.25 Core Upda...

IPFire 2.25 - Remote Code Execution (Authenticated)

Exploit Title: IPFire 2.25 - Remote Code Execution Authenticated Date: 15/05/2021 Exploit Author: Mücahit Saratar Vendor Homepage: https://www.ipfire.org/ Software Link: https://downloads.ipfire.org/releases/ipfire-2.x/2.25-core156/ipfire-2.25.x8664-full-core156.iso Version: 2.25 - core update 15...