关联漏洞
标题：
PHPUnit 安全漏洞
(CVE-2017-9841)
描述：TYPO3是瑞士TYPO3协会维护的一套免费开源的内容管理系统。PHPUnit是其中的一个基于PHP的测试框架。 PHPUnit 4.8.28之前的版本和5.6.3之前的5.x版本中的Util/PHP/eval-stdin.php文件存在安全漏洞。远程攻击者可通过发送以‘<?php’字符串开头的HTTP POST数据利用该漏洞执行任意PHP代码。
描述
Masscanner for Laravel phpunit RCE CVE-2017-9841
介绍
# laravel phpunit rce masscanner CVE-2017-9841
Masscanner for Laravel phpunit RCE **CVE-2017-9841**
## deps
```
python3 -m pip install -r requirements.txt
or
pipenv install -r requirements.txt
```
# Usage
```
usage: tool [-h] [--file <hostnames.txt>] [--range <ip-start>,<ip-end>] [--single SINGLE]
optional arguments:
-h, --help show this help message and exit
--file <hostnames.txt> Input your target host lists
--range <ip-start>,<ip-end> Set range IP Eg.: 192.168.15.1,192.168.15.100
```
# PoC
## Features
- Range of ips with --range Eg: python3 main.py --range 192.168.0.1,192.168.1.253
- List of hostnames --file Eg: python3 main.py --file hostnames.txt
- Dorks see dorks.txt
## References
[https://github.com/sebastianbergmann/phpunit/pull/1956](https://github.com/sebastianbergmann/phpunit/pull/1956)
[https://nvd.nist.gov/vuln/detail/CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
## LOOK HERE
```
+------------------------------------------------------------------------------+
| [!] Legal disclaimer: Usage of this tool for attacking |
| targets without prior mutual consent is illegal. |
| It is the end user's responsibility to obey all applicable |
| local, state and federal laws. |
| Developers assume no liability and are not responsible for any misuse or |
| damage caused by this program |
+------------------------------------------------------------------------------+
```
Bye!
文件快照
[4.0K] /data/pocs/2dbf9faef83953647225bfd04bd0e83d8038969e
├── [ 245] dorks.txt
├── [ 0] error.log
├── [1.2K] main.py
├── [4.0K] modules
│ ├── [3.0K] banner.py
│ ├── [2.1K] executor.py
│ ├── [ 231] file_module.py
│ ├── [ 4] __init__.py
│ └── [1.6K] request_module.py
├── [ 0] output.log
├── [ 153] Pipfile
├── [2.2K] Pipfile.lock
├── [ 86K] poc.png
├── [1.6K] README.md
├── [ 494] requirements.txt
└── [1.0M] tenor.gif
1 directory, 15 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。