Apache NiFi ExecuteProcess RCE

Abuses an unauthenticated or credentialed Apache NiFi REST API to create an ExecuteProcess processor in the root process group, run an OS command, then stop and delete the processor. Requires ExecuteProcess to be available on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Apache NiFi...

Apache NiFi API Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Potential Improvements: Add option to authenticate using client certificate Add a scanner module? class MetasploitModule 'Apache NiFi API Remote Code Execution',...

Apache NiFi API Remote Code Execution

This module uses the NiFi API to create an ExecuteProcess processor that will execute OS commands. The API must be unsecured or credentials provided and the ExecuteProcess processor must be available. An ExecuteProcessor processor is created then is configured with the payload and started. The...