Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2019-19492 PoC — FreeSWITCH 信任管理问题漏洞

Source
Associated Vulnerability
Title:FreeSWITCH 信任管理问题漏洞 (CVE-2019-19492)
Description:FreeSWITCH是美国Anthony Minessale软件开发者的研发的一套免费、开源的通信软件。该软件可用于创建音、视频以及短消息类产品和应用。 FreeSWITCH 1.6.10版本至1.10.1版本中的event_socket.conf.xml文件存在信任管理问题漏洞,该漏洞源于程序没有正确验证用户输入。攻击者可借助特制输入利用该漏洞在系统上执行任意命令。
Readme
# FreeSWITCH Exploit (CVE-2019-19492)

Exploit script for FreeSWITCH by Chocapikk and TrHacknon.

## Description

This script allows you to exploit FreeSWITCH vulnerabilities by executing remote commands. It supports exploitation of a single specified target or automatic generation of a list of targets from Shodan.

## Prerequisites

- Python 3.6+
- shodan library (installed with `pip install shodan`)
- `rich` library (installed with `pip install rich`)
- `prompt_toolkit` library (installed with `pip install prompt_toolkit`)

## Usage

```
python exploit.py [--target TARGET --port PORT] [--auto --pages PAGES --output FILE]
```

Options:
- `--target TARGET`: Specifies a single target IP to exploit.
- `--port PORT`: Specifies a port for the target.
- `--auto`: Automatically generates a list of targets from Shodan.
- `--pages PAGES`: Number of pages to search in Shodan when `--auto` is used.
- `--output FILE`: Specifies the output file for vulnerable targets (default: `vulnerable.txt`).

If you specify `--target TARGET` and `--port PORT`, the script will check the target for vulnerability and open an interactive shell to execute remote commands.

If you use `--auto`, the script will automatically generate a list of targets from Shodan and exploit each target to execute the specified command.

## Notes

- Make sure you have set your Shodan API key as the `SHODAN_API_KEY` environment variable.
- When using the interactive shell, you can enter commands to be executed remotely.
- When you exit the interactive shell, the script will display "Exited shell, deleting" and remove the contents of the output file from the vulnerable targets.

## Warning

This script is provided for educational purposes only. Using this script for malicious activities is strictly prohibited. The author and contributors are not responsible for any misuse or illegal use.

## Authors

- Chocapikk
- TrHacknon
File Snapshot

[4.0K] /data/pocs/e554943a174ed4770b432b13746a717ccbe796cd ├── [7.7K] exploit.py ├── [1.9K] README.md └── [ 51] requirements.txt 0 directories, 3 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.