来源

关联漏洞

描述

Updated exploit for CVE-2021-22911 (Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated))

介绍

# Updated exploit for [CVE-2021-22911](https://nvd.nist.gov/vuln/detail/CVE-2021-22911) (Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated))

> original credits to : [https://www.exploit-db.com/exploits/50108](https://www.exploit-db.com/exploits/50108)
## Setup
- Create python virtual environment and install deps
```bash
$ python -m venv venv
$ source venv/bin/activate
$ pip install requests oathtool
```

## Usage
- I added a new argument `-p` which takes the low privilege user password and also uses the same for reseting admin password
```bash
$ python 50108.py -u "kali@kali.local" -p "<low priv user password>" -a "admin@localhost" -t "http://<ip>:<port>"
```

文件快照

 [4.0K]  /data/pocs/8ced6ef8907bd0a7eab496ec551bcd13886c2606
├── [7.8K]  50108.py
└── [ 680]  README.md

0 directories, 2 files

备注