关联漏洞
标题：
Rengine 安全漏洞
(CVE-2023-50094)
描述：Rengine是一个自动化侦察框架，用于在 Web 应用程序的渗透测试期间收集信息。 reNgine 2.0.2及之前版本存在安全漏洞，该漏洞源于如果攻击者拥有有效的会话 ID，则允许攻击者通过 subprocess.check_output 以 root 身份执行操作系统命令。
描述
poc for CVE-2023-50094 (rengine command injection)
介绍
# reNgine 2.2.0 - Command Injection - CVE-2023-50094
## Description
This Python script exploits an authenticated command injection vulnerability in reNgine 2.2.0. The exploit targets the `nmap_cmd` parameter in the Scan Engine configuration, allowing attackers to execute arbitrary commands.
## Features
- User-friendly command-line interface (CLI)
- Flexible input for base URL, credentials, and Scan Engine ID
- Automates exploitation for authenticated users
## Exploit Details
- **CVE ID**: TBD
- **Affected Version**: reNgine v2.2.0
- **Tested On**: macOS
- **Author on exploit-db**: Caner Tercan
- **Author of the POC**: Ziad (me)
- **Vendor URL**: [https://rengine.wiki/](https://rengine.wiki/)
- **Software Link**: [https://github.com/yogeshojha/rengine](https://github.com/yogeshojha/rengine)
## Prerequisites
1. A running instance of reNgine (v2.2.0).
2. Valid user credentials with access to the Scan Engine configuration.
3. Python 3.x with the `requests` library installed.
## Installation
1. Clone the repository:
```bash
git clone https://github.com/example/rengine-exploit.git
cd rengine-exploit
pip install requests
```
2. Running the script:
```
python poc.py --url http://rengine.target.com --username admin --password securepassword123 --engine-id 2
```
文件快照
[4.0K] /data/pocs/2ac9e893ee7146cd37279df4954378688c98a33a
├── [2.3K] poc.py
└── [1.3K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。