CVE-2019-9053

This repository has the sole purpose of rewriting the CVE-2019-9053 script, which in the original publication is written in Python 2.7. I will be using Python 3.

CVE 2019-9053 Detail Description This code is an implementation of a Time-Based Blind SQL Injection attack in Python 3 The attack is designed to exploit a SQL injection vulnerability in a Content Management System (CMS) Made Simple 228 through an HTTP request Exploit Use: exploitpy -u target-uri -w /path-wordlist -c references

CVE-2019-9053 💻 -c0d3cr4f73r-

Original Exploit Source: https://www.exploit-db.com/exploits/46635

CVE-2019-9053 ---> Python3 Original Exploit Source: wwwexploit-dbcom/exploits/46635 POC video --> attackdefensecom/challengedetailsnoauth?cid=1326 (attackdefense)

CVE-2019-9053 exploit ported to python3

CVE-2019-9053-Python3 CVE-2019-9053 exploit ported to python3

Hi, I'm Jason! Passionate Cybersecurity Student 👨‍💻 My Cybersecurity Related Projects: Cloud SOC Environment using Microsoft Azure / Cloud Creating a Live SOC / honeynet in Azure Vulnerability Management using OpenVAS and Microsoft Azure OpenVAS Vulnerability Management Azure Portal Login Bruteforcer Using Powershell Azure Portal Login Bruteforcer Micr

TryHackMe SimpleCTF Walkthrough Introduction SimpleCTF is a beginner level CTF designed to demonstrate necessary skills needed when it comes to all CTFs such as scanning, enumeration, research, explotation, and privilege escalation In this CTF I will walk through each question along with the steps I took to find the answers We are given an IP address to start Upon visiting t

CVE-2019-9053 Exploit for Python 3

CVE-2019-9053 CVE-2019-9053 Exploit for Python 3 Last tested: 28-12-2021 Tested on: Python 3101 Original Exploit Source: wwwexploit-dbcom/exploits/46635 Users take full responsibility for any actions performed using this tool If these terms are not acceptable to you, then do not use this tool Please use this tool only in environments where you have permissions to

CVE-2019-9053 Exploit for Python 3

CVE-2019-9053 CVE-2019-9053 Exploit for Python 3 Last tested: 28-12-2021 Tested on: Python 3101 Original Exploit Source: wwwexploit-dbcom/exploits/46635 Users take full responsibility for any actions performed using this tool If these terms are not acceptable to you, then do not use this tool Please use this tool only in environments where you have permissions to

CMS Made Simple < 2.2.10 - SQL Injection

CVE-2019-9053 CMS Made Simple &lt; 2210 - SQL Injection

guncel-cve-2019-9053py

CMS-Made-Simple-2210---SQL-Injection-Exploit-com-corre-o-de-Bugs O exploit foi corrigdo para suportar o python 3 CVE-2019-9053 Fonte de exploração original: wwwexploit-dbcom/exploits/46635 Possivel erro e sua correção Traceback (most recent call last): File "46635py", line 12, in from termcolor import colored ImportError:

Walkthrough for the HTB Writeup box

HTB-Writeup Box: Writeup IP: 101010138 Browsing to 101010138/ we see a warning about an 'Eeyore DoS protection script' so we probably shouldn't do any dirbusting The /robotstxt file has a disallow in place for /writeup/ so of course we'll want to check that out The source code for 101010138/writeup/ shows the website is using CMS M

List of common scripts for exploitation that are working (Easy Access)

Useful-Scripts List of common scripts for CVEs that are working (Easy Access) CVE-2014-6287 HTTP File Server Remote Code Execution githubcom/oplogix/Helpful-Scripts/blob/main/CVE-2014-6287py CVE-2019-9053 CMS Made Simple &lt; 2210 - SQL Injection githubcom/oplogix/CVE-Scripts/blob/main/CVE-2019-9053py PHP-Reverse-Shell php file uploadable to php site

Simple CTF Write Up for THM

Welcome to my first write up its about the Try Hack Me box Simple CTF wwwtryhackmecom/room/easyctf I want to start by saying im a novice in the CTF environment, so any comment about how to improve my craft will be appretiated, also im gonna use the IP that was given to me for claritie's sake First I started ennumerating the services exposed in the machine by usin

CVE 2019-9053 Python 3 Update

super-octo-carnival CVE 2019-9053 Python 3 Update Original: wwwexploit-dbcom/exploits/46635 Tested on 3112 By using this tool, you acknowledge and agree that you are solely responsible for any actions taken using it You understand that the tool is intended for authorized penetration testing activities in environments where you have obtained proper permissions It i

CVE-2019-9053-Exploit-in-Python-3 This is an exploit used in TryHackMe's EasyCTF However the code that is installed within Kali Linux or going to exploitDB has outdated Python 2 code This is a rewrite of that, and some revisions were made when cracking the password's hash, since there was a bug when running with Python 3 This is so that you can run the EasyCTF the w

CVE script for simple CTF on THM

Edits to exploit written for CVE-2019-9053, from exploitdb Originally by Exploit Author: Daniele Scanu @ Certimeter Group see comments in code for details changes made to allow for use with python 3 as original code was in python 2 again, I only edited the orignal code I did not write it For use in TryHackMe CTF: tryhackmecom/r/room/easyctf this code is UNTESTED and m

CVE-2019-9053 Original post can be found here Tested on Python 311 I don't take any responsibility for missuse or unauthorized use of this script Check out the blog post for more information about this script Requirements pip3 install httpx

This repo will contains the old exploits with the updated version of code. (Example python updated to python3)

CVE-s-Working-Exploits This repo will contains the old exploits with the updated version of code (Example python updated to python3) CVE-2019-9053

TryHackMe: Simple CTF Writeup

Simple CTF Writeup: Alright, lets get started! Enumeration: NMap Scan: First things first, I started with the following NMap scan: sudo nmap -sS -vv -sC -sS -sV -oN nmapouttxt {MACHINE_IP} We have the following 3 ports open: PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 63 vsftpd 303 80/tcp open htt

List of common scripts for exploitation that are working (Easy Access)

Useful-Scripts List of common scripts for CVEs that are working (Easy Access) CVE-2014-6287 HTTP File Server Remote Code Execution githubcom/oplogix/Helpful-Scripts/blob/main/CVE-2014-6287py CVE-2019-9053 CMS Made Simple &lt; 2210 - SQL Injection githubcom/oplogix/CVE-Scripts/blob/main/CVE-2019-9053py PHP-Reverse-Shell php file uploadable to php site

TryHackMe Simple CTF

THM-Simple CTF write-up tryhackmecom/room/easyctf &gt;&gt; Created by MrSeth6797 Attack machine : THM Attackbox via the browser A Simple CTF it is just that!! A CTF for noobs like myself who can hone their skills and intuitions required for ethical hacking and CTF challenges Task 1 - Simple CTF The fisrt step I took in this challenge was to conduct a port sc

This is modified code of 46635 exploit from python2 to python3.

46635py_CVE-2019-9053 This is modified code of 46635 exploit from python2 to python3 run file contain 46635 modified code Download run file and use this

Python3 version of the Python2 exploit for CVE-2019-9053

CVE-2019-9053-Python3 Description This is an updated 2023 version (adapted for Python3) of the Python2 exploit for CVE-2019-9053 created by Daniele Scanu @ Certimeter Group in 2019 All I did was adapt the code for Python3 All credit goes to Daniele Scanu for the original exploit Information Description Exploit Title Unauthenticated SQL Injection on CMS Made Simple &am

CVE-2019-9053 💻 -c0d3cr4f73r-

"Presenting the upgraded code for CVE-2019-9053 SQL injection vulnerability Our program is now stronger against security threats Check out the improvements below" ⚠️ Caution: This code is intended solely for educational and security testing purposes Usage on any system without proper authorization is strictly prohibited Unauthorized use may result in legal co

CVE-2019-9053 💻 -c0d3cr4f73r-

CVE-2019-9053 💻 -c0d3cr4f73r-

Simple CTF, es un desafio de THM que se puede resolver utilizando inyección sql, para posteriomente realizar el escalamiento de privilegios utilizando el editor de texto Vim Enumeración Pregunta 1: Cuantos servicios se encuentran por debajo del puerto 1000? How many services are running under port 1000? nmap -sV -sC ip_objetivo Respuesta: 2 Pregunta 2: Que servi

CMS Made Simple < 2.2.10 - SQL Injection (rewritten for python3), CVE-2019-905

CMS-made-simple-sqli-python3 CMS Made Simple &lt; 2210 - SQL Injection (rewritten for python3), CVE-2019-9053 I found it problematic to run this exploit on kali linux, since python2 doesn't have termcolor, so with very few brackets I made it working with python3 All credit goes to: wwwexploit-dbcom/exploits/46635 I tested it against a cms vulnerable machi

CMS-Made-Simple-2210---SQL-Injection-Exploit-com-corre-o-de-Bugs O exploit foi corrigdo para suportar o python 3 CVE-2019-9053 Fonte de exploração original: wwwexploit-dbcom/exploits/46635 Possivel erro e sua correção Traceback (most recent call last): File "46635py", line 12, in from termcolor import colored ImportError:

Simple CTF Export the IP export IP=1010157157 How many services are running under port 1000? 2 What is running on the higher port? ssh What's the CVE you're using against the application? CVE-2019-9053 &lt;code&gt; python2 exploitpy -u url -w rockyoutxt [-p]&lt;/code&gt; salt=1dac0d92e9fa6bb2 [-p] didn't actually find the password so

SimpleCTF My notes for TryHackMe's Simple CTF challenge Recon Nmap $ nmap -A TARGET_IP PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 303 | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_Can't get directory listing: TIMEOUT | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:101063127 | Logged in as ftp | TYPE:

The exploit is edited to work with different text encodings and Python 3 and is compatible with CMSMS version 2.2.9 and below.

CVE-2019-9053 Exploit (Python 3) This repository contains an exploit for the vulnerability CVE-2019-9053 found in the CMS Made Simple (CMSMS) software The exploit has been modified to work with Python 3 and is compatible with CMSMS version 229 and below Description CVE-2019-9053 is a vulnerability that allows an attacker to execute arbitrary code and gain unauthorized acces

CMS Made Simple<2.2.10-SQL Injection

CMSMadeSimple-SQLinjection CMS Made Simple&lt;2210-SQL Injection Exploit Title: Unauthenticated SQL Injection on CMS Made Simple &lt;= 229 Date: 30-03-2019 Exploit Author: Daniele Scanu @ Certimeter Group Vendor Homepage: wwwcmsmadesimpleorg/ Software Link: wwwcmsmadesimpleorg/downloads/cmsms/ Version: &lt;= 229 Tested on: Ubuntu 1804 LTS

Improved code of Daniele Scanu SQL Injection exploit

CVE-2019-9053 Improved code of Daniele Scanu SQL Injection exploit Following changes applied: Added time control variable -t or --time that enables user to extend the timing of SQL injection (useful if a network connection in between hosts is subject of delays with packet transmission) Network exception handling added: to retry in case of a packet/connection/response lost (ori

exploits, tools and miscellaneous

exploits exploits, tools and miscellaneous CVE-2015-6854 Exploit a remote unauthenticated memory disclosure in Siteminder SSO / CA SSO Incorrect decoding of URL results in improperly terminated and reflected string value CVE-2018-1212 Exploits two weak cryptographic session token mechanisms in iDRAC 6 web interfaces to obtain authentication credentials and then deploys a CVE-2

working exploit for CVE-2019-9053

CVE-2019-9053-exploit working exploit for CVE-2019-9053 I edited oryginal exploit and now its working well Oryginal exploit had some problems like missing syntax Usage: Example usage (no cracking password): exploitpy -u target-uri Example usage (with cracking password): exploitpy -u target-uri --crack -w /path-wordlist If you get this when cracking a password:

Simple CTF IP: 101020042 PORTS nmap -A 21 80 2222 21 anonymous allowed pub/ForMitchtxt 80 apache2 default /simple /simple CMS made simple v228 whenever there is a CMS, exploitDB ExploitDB CVE-2019-9053 sqli for &lt;v2210 [+] Salt for password found: 1dac0d92e9fa6bb2 [+] Username found: mitch [+] Email found: admin@ad

Simple-CTF-walkthrough #Step 1 How many services are running under port 1000? Run nmap -A {target IP} results in: 2 ports under 1000 and 1 port over 1000 -21/tcp open ftp vsftpd 303 *note-ftp-anon:Anonymous FTP login allowed -80/tcp open http Apache httpd 2418 -2222/tcp open ssh Openssh 72p2 #Step 2 CLI - ftp {target} ({target}:root): Anonymous