POC详情: 37bf2f8e61b96db818a8945f4d2625b514ecec2c

来源
关联漏洞
标题: Zyxel NAS326和Zyxel NAS542 操作系统命令注入漏洞 (CVE-2024-29973)
描述:Zyxel NAS542和Zyxel NAS326都是中国合勤(Zyxel)公司的产品。Zyxel NAS542是一款NAS(网络附加存储)设备。Zyxel NAS326是一款云存储 NAS。 Zyxel NAS326 V5.21(AAZF.17)C0之前版本、NAS542 V5.21(ABAG.14)C0之前版本存在操作系统命令注入漏洞,该漏洞源于setCookie参数中存在命令注入漏洞,从而导致攻击者可通过HTTP POST请求来执行某些操作系统 (OS) 命令。
描述
Exploiter a Vulnerability detection and Exploitation tool for CVE-2024-29973 with Asychronous Performance.
介绍
# CVE-2024-29973
Exploiter a Vulnerability detection and Exploitation tool for CVE-2024-29973 with Asychronous Performance.

### Installation:
```bash
git clone https://github.com/RevoltSecurities/CVE-2024-29973
pip install -r requirements.txt
python3 exploit.py --help
```

### Usage:
```yaml
python3 exploit.py  -h                                               


    ______     ____  __         _ ______         
   / ____/  __/ __ \/ /  ____  (_)_  __/__  _____
  / __/ | |/_/ /_/ / /  / __ \/ / / / / _ \/ ___/
 / /____>  </ ____/ /__/ /_/ / / / / /  __/ /    
/_____/_/|_/_/   /_____|____/_/ /_/  \___/_/     
  
                    @RevoltSecurities

[Description]: Vulnerability Detection and Exploitation tool for CVE-2024-29973

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     [INF]: Specify a URL or domain for vulnerability detection
  -l LIST, --list LIST  [INF]: Specify a list of URLs for vulnerability detection
  -t THREADS, --threads THREADS
                        [INF]: Number of threads for list of URLs
  -proxy PROXY, --proxy PROXY
                        [INF]: Proxy URL to send request via your proxy
  -v, --verbose         [INF]: Increases verbosity of output in console
  -o OUTPUT, --output OUTPUT
                        [INF]: Filename to save output of vulnerable target]
```


### About :

The tool is Developed by [D.Sanjai Kumar @RevoltSecurities](https://www.linkedin.com/in/d-sanjai-kumar-109a7227b/) to detect and exploit the Vulnerability Command Injection CVE-2024-249973, The tool is only for education and ethical purpose only and 
Developers are not responsible for any illegal exploitations.
文件快照

[4.0K] /data/pocs/37bf2f8e61b96db818a8945f4d2625b514ecec2c ├── [6.6K] exploit.py ├── [1.6K] README.md └── [ 92] requirements.txt 0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。