CVE-2024-1651 PoC — Torrentpier 代码问题漏洞

Source

https://github.com/sharpicx/CVE-2024-1651-PoC

Associated Vulnerability

Title:Torrentpier 代码问题漏洞 (CVE-2024-1651)
Description:Torrentpier TorrentPier是Torrentpier公司的一个公牛驱动的 BitTorrent 公共/私人跟踪器引擎。 Torrentpier 2.4.1版本存在代码问题漏洞，该漏洞源于存在反序列化漏洞，导致攻击者可以在服务器上执行任意命令。

Description

Python script to automate generic gadget chain from CVE-2024-1651. There's missed length and nullbytes URL Encoding.

Readme

# CVE-2024-1651
This CVE was discovered by Carlos Bello from the Fluid Attack Offensive Team. The finding discusses Insecure Object Deserialization to obtain RCE (Remote Code Execution). Here, I have created a faster and easier-to-use PoC (Proof of Concept). Therefore, if anyone wants to reproduce the finding, they can use this as a reference example.

# Preview
![image](https://github.com/sharpicx/CVE-2024-1651-PoC/assets/44630640/db60cb47-3992-4bfd-a177-925cec06ddc4)

File Snapshot


 [4.0K]  /data/pocs/abd64975e3f22899b60310b25e924bdf9c65f91f
├── [4.2K]  exploit.py
├── [1.0K]  LICENSE
└── [ 476]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!